Vice President, Assessments & Assurance

Role Purpose

The Vice President, Assessments & Assurance leads the global delivery of operational resilience due diligence and ongoing assurance for in-scope third parties. The role owns the content and quality of Due Diligence Questionnaires (DDQs), runs the annual programme of third-party assessments, and turns supplier evidence into clear findings, associated risks, remediation plans, mitigations and, where appropriate, risk acceptances.

Acting as the principal ERO interface with TPRM, and working through Business Continuity Directors with Business Relationship Managers and Engagement Managers, the VP keeps assessments consistent, evidence-based and proportionate to supplier criticality. The role acts as the "maker" of assessment outputs, which the VP – Contracting, Validation & Reporting then independently validates. It also supports on-site inspections, assessment workshops and joint third-party testing.

Key Responsibilities

1. Stakeholder & Relationship Management

• Own and manage the relationship between the ERO and Third-Party Risk Management (TPRM), aligning operational resilience due diligence with the wider third-party risk lifecycle.
• Work through Business Continuity Directors (BCDs) to manage relationships with Business Relationship Managers (BRMs) and Engagement Managers (EMs) for all DDQ, finding and risk activity.
• Engage directly with suppliers to set clear expectations for evidence, timelines and participation in assurance activity.

2. Due Diligence Methodology

• Define, draft and maintain operational resilience Due Diligence Questionnaires, together with assessment procedures, scoring guidance, evidence standards and assessor job aids.
• Make sure DDQs cover supplier governance, business continuity, technology and cyber recovery, data resilience and immutability, incident management, testing, subcontractor and fourth-party dependencies, and contingency and exit capability.
• Refresh DDQ content each year to reflect policy changes, regulatory expectations, lessons learned and emerging threats.

3. Annual Third-Party Assessments

• Plan and carry out annual third-party assessments, plus new-engagement and event-driven reviews, prioritised by criticality, service impact, concentration, substitutability and prior performance.
• Lead evidence reviews and supplier interviews, challenging incomplete or inconsistent responses and obtaining enough support to reach defensible conclusions.
• Keep assessment records complete, traceable and ready for regulators in approved systems, and keep workflows moving on time.

4. Findings, Risks, Remediation & Risk Acceptance

• Draft clear, evidence-based findings and identify the associated risks, including potential impact on Critical and Important Business Services and impact tolerances.
• Draft proportionate remediation plans and mitigations with named owners, priority ratings and target dates, agreed with suppliers, BRMs and EMs.
• Draft risk acceptances where remediation is not feasible or proportionate, clearly setting out residual risk, compensating controls and review dates.
• Pass findings, risks, remediation plans and acceptances to the VP – Contracting, Validation & Reporting for independent validation before approval or escalation.

5. On-Site Inspections, Workshops & Joint Testing

• Support on-site visits and inspections of third parties, including preparation, evidence sampling, observation and documentation of outcomes.
• Support assessment workshops with suppliers and internal stakeholders to explore resilience capability, dependencies and recovery arrangements in depth.
• Support joint third-party testing by contributing assessment insight to scenario design, taking part in execution and recording observations as findings where appropriate.

6. Quality, Leadership & Continuous Improvement

• Monitor assessment quality, throughput, ageing, coverage and recurring themes, and escalate delivery constraints or material supplier concerns to the Managing Director.
• Lead, coach and quality-control the analysts carrying out assessments, using calibration sessions, training and lessons learned to build consistency.
• Promote responsible use of tooling, analytics, automation and AI to improve DDQ workflow, evidence capture, consistency and insight.

Experience, Skills & Qualifications

• Substantial experience in third-party risk management, operational resilience, business continuity, supplier assurance, technology or cyber risk within financial services or another highly regulated sector.
• Demonstrated experience designing or carrying out due diligence and ongoing monitoring programmes, including DDQ design, evidence review, drafting findings and assessing risk.
• Strong understanding of critical services, recovery objectives, impact tolerances, concentration risk, substitutability and fourth-party dependencies.
• Excellent analytical judgement and the ability to turn complex evidence into concise, defensible conclusions and practical remediation actions.
• Strong facilitation, supplier engagement and stakeholder-influencing skills, with a disciplined approach to documentation and quality.
• Bachelor's degree or equivalent professional experience required; relevant professional certification in third-party risk, operational resilience, business continuity, technology risk, cyber or audit preferred.

Leadership Expectations

• Builds a culture of evidence-based challenge, consistency, transparency and accountability.
• Balances timely delivery with rigorous assessment, and escalates material uncertainty rather than accepting weak evidence.
• Builds trusted, collaborative relationships with TPRM, BCDs, BRMs, EMs and suppliers.
• Develops team capability and represents assessment outcomes credibly to senior stakeholders, auditors and regulators.

Salary Range:

$110,000 - $181,250 Annual

The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.

Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax advantaged savings plans.

For a full overview, visit https://hrportal.ehr.com/statestreet/Home.

About State Street

Across the globe, institutional investors rely on us to help them manage risk, respond to challenges, and drive performance and profitability. We keep our clients at the heart of everything we do, and smart, engaged employees are essential to our continued success.

We are committed to fostering an environment where every employee feels valued and empowered to reach their full potential. As an essential partner in our shared success, you’ll benefit from inclusive development opportunities, flexible work-life support, paid volunteer days, and vibrant employee networks that keep you connected to what matters most. Join us in shaping the future.

As an Equal Opportunity Employer, we consider all qualified applicants for all positions without regard to race, creed, color, religion, national origin, ancestry, ethnicity, age, disability, genetic information, sex, sexual orientation, gender identity or expression, citizenship, marital status, domestic partnership or civil union status, familial status, military and veteran status, and other characteristics protected by applicable law.

Discover more information on jobs at StateStreet.com/careers

Read our CEO Statement

Job Application Disclosure:

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.