Third-Party Risk Management Officer

Looking to join a Great Place to Work Employer and become a valued member of our growing team? At SmartBank, we're not just offering a job; we're inviting you to be a part of a culture built on excellence.

Responsible for administering and overseeing the Bank's Third-Party Risk Management (TPRM) program across the full third-party relationship lifecycle, including planning, due diligence, risk assessment, contract risk review coordination, ongoing monitoring, issue escalation, termination, and board management reporting.

Ensures vendors, service providers, and other third-party relationships are managed consistent with regulatory expectations, contractual obligations, the Bank's risk appetite, and operational resilience objectives while partnering with business owners, Information Security, Compliance, Legal, Procurement, and other control functions to drive accountability for effective third-party oversight.

Major Duties and Responsibilities:

Core Values & Culture Commitment:

• Uphold SmartBank Core Values and Core Purpose.
• Adheres to and embraces the SmartBank Way by Acting Smart, Looking Smart and Being Smart. 

General Responsibilities:

• Manage the full third-party lifecycle, including planning, risk assessment, due diligence, contract review coordination, monitoring, escalation, offboarding, and termination.

• Perform risk-based due diligence covering SOC reports, financial condition, cybersecurity, privacy, business continuity, insurance, subcontractors, compliance documentation, and unresolved control issues.

• Maintain the third-party inventory, risk tiering, criticality designations, ownership assignments, service descriptions, data access indicators, fourth-party considerations, and risk classifications.
• Coordinate contract and service agreement reviews to identify operational, compliance, security, privacy, business continuity, audit rights, service level, termination, subcontracting, and transition risks.

• Track remediation, document risk acceptances or exceptions, escalate overdue or high-risk issues, validate corrective actions, and drive timely resolution.

• Facilitate risk-based annual and periodic vendor reviews based on policy, regulatory expectations, risk ratings, criticality, performance, control changes, and material relationship changes.

• Monitor concentration risk, fourth-party and subcontractor dependencies, geographic or service-provider exposure, and emerging risks affecting operations, customers, compliance, or resilience.

• Prepare management and board reporting on vendor risk metrics, critical and high-risk providers, due diligence status, overdue reviews, open issues, risk acceptances, emerging risks, concentration risk, exceptions, and program effectiveness.

• Partner with Information Security, Compliance, Legal, Procurement, Finance, Business Continuity, Operational Risk, Internal Audit, and other Business Units to support oversight and reinforce business-owner accountability.

• Maintain accurate, accessible documentation supporting due diligence, risk assessments, monitoring, issue management, risk acceptance, reporting, audits, exams, and regulatory reviews.

• Monitor regulatory guidance and industry practices related to third-party risk management.

• Coordinate annual SOX-related vendor reviews, including SOC report and vendor control assessments impacting financial reporting and key business processes.

Position Requirements and Qualifications:

Education:

• Bachelor's degree in Business Administration, Finance, Accounting, Risk Management, Information Systems, Information Security, or related field preferred.

• Relevant banking, risk management, compliance, or information security experience may be considered in lieu of a degree.

• Minimum of 5+ years of experience in vendor management, third-party risk management, information security, compliance, audit, enterprise risk management, procurement, or banking operations.

Training  (licenses, programs, or certificates):

• CRVPM (Certified Regulatory Vendor Program Manager) preferred.
• CTPRP (Certified Third-Party Risk Professional) preferred.
• CRCM, CISA, CRISC, CISSP preferred.

Knowledge, Skills, and Abilities:

• Ability to apply knowledge and sound judgment in decision-making using established guidelines.
• Strong written and oral communication skills.
• Detail oriented and ability to function in a team environment.
• Demonstrates ability to maintain a positive attitude.
• High level of integrity.
• Able to maintain regular and predictable attendance.
• Must possess the ability to handle multiple tasks simultaneously, with frequent interruptions.
• Must be able to able to prioritize and organize daily workflow.
• Strong relationship management and business development/sales skills.
• Thorough knowledge of bank products and services.
• Knowledge of third-party risk management laws, regulations, and supervisory expectations, including interagency guidance, FFIEC guidance, GLBA, privacy, business continuity, and banking regulator expectations.
• Strong analytical, organizational, communication, relationship management, issue management, documentation, project management, and executive reporting skills, with the ability to constructively challenge and escalate risk issues.
• Working knowledge of FFIEC, GLBA, OCC, FDIC, Federal Reserve, and interagency third-party risk management guidance.
• Experience reviewing contracts, SOC reports, risk assessments, business continuity documentation, and regulatory compliance materials.
• Experience preparing executive and board-level reporting.
• Experience supporting regulatory examinations and audits.
• Extensive experience with Examiner interactions.

Work Conditions:

• Able to routinely stand, sit, bend and stoop.

• Frequently and regularly required movements using wrists, hands, and/or fingers.
• Average, ordinary, visual acuity necessary to prepare and inspect documents or products and operate machinery.
• Ability to hear average or normal conversations and receive ordinary information.
• May be required to travel to training sessions or meetings.