GENERAL FUNCTION:As first line of defense, conducts analysis related to identifying, assessing, mitigating, and managing risks necessary to comply with new or changing laws, regulations, regulatory guidance, and best practices deemed necessary by key stakeholders (such as Third Party Management, Legal, Information Security, Compliance, Enterprise Risk and Audit partners). Supports Business Controls in advancing risk management, structure, processes, and tools in support of the organization's Enterprise Risk Management (ERM) framework. Transforms data into business intelligence by developing and presenting information and insights to stakeholders. Monitors and manages risks to ensure compliance and validation of program effectiveness with assigned line of business or functional area, and Bancorp initiatives.
Responsible and accountable for risk by openly exchanging ideas and opinions, elevating concerns, and personally following policies and procedures as defined. Accountable for always doing the right thing for customers and colleagues and ensures that actions and behaviors drive a positive customer experience. While operating within the Bank's and LOB's risk appetites, achieves results by consistently identifying, assessing, managing, monitoring, and reporting risks of all types.
ESSENTIAL DUTIES AND RESPONSIBILITIES:- Assist Business Controls leadership with the development and implementation of controls, policies, procedures, and risk mitigation strategies.
- Provide expertise related to the identification, assessment, monitoring, testing, and reporting of operational, compliance, information security, and third-party risks.
- Conduct third-party due diligence activities, including onsite assessments, site visits, assurance reviews, and risk assessments.
- Travel domestically and internationally to perform onsite third-party assessments and evaluate compliance with Bank requirements.
- Review assurance reports, including SOC 1, SOC 2, ISO SoA, audit reports, and other compliance documentation.
- Perform third-party risk assessments to evaluate third-party compliance with internal policies, contractual obligations, regulatory requirements, and industry standards.
- Review contracts and security requirements to assess third-party obligations, risks, and control expectations.
- Evaluate information security controls, data privacy controls, restricted environments, and secure workflow processes.
- Review vulnerability management programs, vulnerability assessments, penetration testing results, and remediation activities.
- Support ongoing monitoring activities, periodic reassessments, and third-party lifecycle management processes.
- Investigate and assist with root cause analysis for control failures, operational losses, audit findings, and risk events.
- Support issue management activities, including remediation tracking, validation of corrective actions, and issue closure.
- Identify control breakdowns, process inefficiencies, and risk exposures and recommend corrective actions.
- Support internal audits, external audits, regulatory examinations, and compliance reviews.
- Monitor and assess compliance with applicable laws, regulations, standards, and industry best practices, including OCC Heightened Standards.
- Build and maintain effective relationships with Third-Parties, Business Partners, Legal, Compliance, Enterprise Risk, Information Security, and Internal Audit.
- Coordinate risk assessments, control reviews, issue remediation efforts, and governance activities across multiple stakeholders.
- Maintain assessment, issue, exception, and risk documentation within Archer, Coupa, Power BI, and other governance tools.
- Assist with regulatory change management activities and the implementation of new risk management requirements.
- Participate in escalated supplier-related issues and support enterprise risk mitigation efforts.
- Support special projects, acquisitions, strategic investments, and other risk management initiatives as required.
- Executes on ERM Scenario Analysis risk management program.
- Develop and manage product inventory and execute on ERM product risk review program.
- May have additional responsibilities as assigned by LOB/Function leadership and Risk, including but not limited to:
- Assistance with new government programs or special internal projects.
- Assistance with new risk programs required by regulatory authorities or ERM.
- Assistance with diligence, closing, and other matters relating to acquisitions and strategic investments.
MINIMUM KNOWLEDGE AND SKILLS REQUIRED:- Bachelor's degree or equivalent experience required (related field preferred).
- Master's degree in relevant field preferred.
- Recognized industry certifications such as Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), or equivalent is required.
- 5 + years of financial services industry, risk, business controls or compliance experience preferred.
- Experience performing due diligence activities, including: Third Party Onsite assessments, Assurance report reviews (SOC 1, SOC 2, ISO 27001 etc.), Risk assessments, Vulnerability Management Analysis and Assessments.
- Understanding of IT systems, infrastructure, cybersecurity risk and data privacy principles.
- Contract & Governance: Contract reviews, Security requirements reviews, Exception management and Issue management.
- Travel Requirements: Ability and willingness to travel as needed to conduct onsite third-party assessments, due diligence reviews, and relationship management activities.
- Professional verbal and written communication skills and the ability to communicate with discretion and understanding when confidentiality is needed.
- Must be analytical and possess ability to interpret and apply policies and regulations across a complex business.
- Must proactively identify opportunities and take action to build trusting strategic internal and external relationships and networks.
- Must be approachable, collaborative, and have the ability to influence others through interpersonal skills, thrive in a fast-paced dynamic environment, and be comfortable quickly shifting priorities on short notice.
- Working knowledge of Microsoft Office products required.
- Experience with tools such as Coupa, Archer, and Power BI is preferred
- Ability to work with minimal supervision.
- For Investment Advisors: FINRA Series 7 and 63/66 licenses preferred. Knowledge of the Securities industry and SEC / FINRA regulations is preferred.
Business Controls Senior Associate - Third Party
The base salary for this position is reflective of the range of salary levels for all roles within this pay grade across the U.S. Individual salaries within this range will vary based on factors such as role, relevant skillset, relevant experience, education and geographic location. In addition to the base salary, this role is eligible to participate in an incentive compensation plan, with any such payment based upon company, line of business and/or individual performance.
Our extensive benefits programs are designed to support the individual needs of our employees and their families, encompassing physical, financial, emotional and social well-being. You can learn more about those programs on our 53.com Careers page at: https://www.53.com/content/fifth-third/en/careers/benefits.html or by consulting with your talent acquisition partner.
LOCATION -- Cincinnati, Ohio 45202
Attention search firms and staffing agencies: do not submit unsolicited resumes for this posting. Fifth Third does not accept resumes from any agency that does not have an active agreement with Fifth Third. Any unsolicited resumes - no matter how they are submitted - will be considered the property of Fifth Third and Fifth Third will not be responsible for any associated fee.
