Role Overview:

The role will support the Bank's second line of defense responsibilities and play a key role in overseeing third-party risk governance, regulatory compliance, vendor risk assessments, ongoing monitoring, issue remediation tracking, and management risk reporting.

Experience:

- Minimum 5+ years of relevant experience in Third-Party Risk Management, Vendor Governance, Information Security Risk, Operational Risk, or Internal Audit.

- Prior experience in Banking, Financial Services, FinTech, or regulated environments preferred.

Key Responsibilities:

- Manage and enhance the TPRM framework, policies, standards, and governance processes.

- Oversee the end-to-end third-party lifecycle, spanning vendor discovery, due diligence, risk scoring, contract risk clauses, ongoing monitoring, and offboarding/termination.

- Maintain an accurate, centralized repository of all third-party vendors, critical suppliers, and fourth party (subcontractor) dependencies oversight.

- Conduct independent risk assessments for vendors across cyber security, data privacy, operational resilience, financial stability, regulatory compliance, and business continuity domains.

- Review outsourcing and critical vendor arrangements and ensure compliance with applicable regulatory requirements.

- Coordinate with Procurement, Legal, Information Security or CISO, Compliance, and Business Teams for risk evaluations and contract governance i.e., SLA, incident etc.

- Manage third-party incidents, escalations, exception approvals, and vendor offboarding activities.

- Support audits, regulatory examinations, management reporting, and governance committee updates.

- Review and manage risk acceptance requests or policy deviations, ensuring proper escalation to senior management or risk committees when high-risk tolerance thresholds are breached.

- Track identified vendor vulnerabilities, audit findings, or compliance gaps to closure, working closely with vendor relationship managers in the first line.

- Collaborate with business unit vendor owners to monitor key performance indicators (KPIs) and service-level agreements (SLAs).

Preferred Qualifications:

- Bachelor's degree in Business Administration, Risk Management, Cybersecurity or related field.

- Professional certifications such as CRISC, CISA, CISSP, CTPRP, or equivalent would be an added advantage.

- Hands-on experience with GRC/TPRM platforms such as Archer, ServiceNow or similar GRC tools.

- Strong understanding of RBI Outsourcing Guidelines, Operational Risk Management, Information Security, ISO 27001, NIST, SOC reports, and regulatory compliance frameworks.

Key Competencies:

- Strong analytical and risk assessment capabilities.

- Effective stakeholder management and communication skills.

- Ability to independently manage multiple assessments and governance activities.

- Experience in presenting risk insights and remediation status to senior management and governance forums.