Third Party Risk Manager

As Mercury prepares to become a bank, our Third Party Risk Management (TPRM) program is in active development to meet bank-level regulatory expectations. As an early member of a growing TPRM team, you’ll help run the program day-to-day and contribute how it matures, bringing your own judgment and point of view to a function that is usually more rigidly defined, with room to be creative and make your mark.

As a Third Party Risk Manager, you’ll help protect Mercury, our customers, and the broader financial ecosystem from the risks that come with relying on third parties. Reporting to the Senior Manager, Third Party Risk Management, you’ll complete third-party risk assessments, support risk reporting, and provide second-line oversight.

As a Third Party Risk Manager, you will play a key part in helping protect Mercury, our customers, and the broader financial ecosystem from the risks associated with third parties. Reporting to the Senior Manager, Third Party Risk Management, you will conduct third party risk assessments, help build out related risk reporting, and carry out second line oversight activities to help reduce the impact of third-party risks.

This position focuses on enterprise-wide TPRM, rather than in-depth expertise in a specific domain like security or privacy. You will work closely with subject-matter experts across Compliance, Information Security, Privacy, and Procurement to make sure their requirements are reflected in the program, bringing a view across the full third-party lifecycle and the regulatory expectations that come with banking.*

Key Responsibilities:

• Assess and risk rate: Complete third-party risk assessments, risk rate third parties, and open and track issues through resolution.
• Second-line oversight: Review and challenge first-line due diligence and ongoing monitoring, including reporting, approvals and oversight of those activities. First-line owners remain accountable for managing the third-party relationship, including SLAs, business reviews, exit strategies and onboarding.
• Reporting and data: Support maintenance of third party risk reporting and metrics for management and governance forums, and help keep the underlying data accurate.
• Tooling and automation: Help implement tooling and automation to make processes more efficient
• Program uplift: Support and contribute to uplift efforts across the TPRM program, including updates to policies, due diligence, risk assessment processes, and risk management across the third party lifecycle

Required Qualifications:

• 4+ years of third party risk management experience, including 2+ years in a regulated financial services environment (bank, or fintech working with bank partners)
• Working knowledge of regulatory guidance on third party risk, including the Interagency Guidance on Third Party Relationships (and related FFIEC, OCC and FDIC expectations), and TPRM industry practices across the third party lifecycle (planning, due diligence, contracting, monitoring, termination)
• Hands-on experience completing third party risk assessments across multiple risk domains, not only security
• Experience reviewing and challenging first-line risk work with evidence-based pushback
• Experience supporting audits or exams of a TPRM program (gathering evidence, responding to requests, following up on findings)
• Experience building or maintaining TPRM reporting and metrics, with attention to data accuracy
• Solid program and project management skills, with experience supporting a program that spans multiple cross-functional components and driving process improvements through to implementation
• Proven ability to influence cross-functional partners (Procurement, Finance, InfoSec, Legal, Privacy) without direct authority
• Clear communicator who can explain a risk position and hold it under pushback

Preferred Qualifications:

• Experience at a bank, or a fintech moving toward banking
• Experience improving or uplifting an existing TPRM program
• Experience with TPRM tooling, automation or AI-enabled workflows
• Familiarity with enterprise risk concepts (risk register, risk appetite, committee reporting)
• Relevant certification (e.g., CISA, CGRC)

*Mercury is a fintech company, not an FDIC-insured bank. Banking services provided through Choice Financial Group and Column N.A., Members FDIC.

Mercury values diversity & belonging and is proud to be an Equal Employment Opportunity employer. All individuals seeking employment at Mercury are considered without regard to race, color, religion, national origin, age, sex, marital status, ancestry, physical or mental disability, veteran status, gender identity, sexual orientation, or any other legally protected characteristic. We are committed to providing reasonable accommodations throughout the recruitment process for applicants with disabilities or special needs. If you need assistance, or an accommodation, please let your recruiter know once you are contacted about a role.

Originally posted on Himalayas