The selected colleague will work at an MUFG office or client sites four days per week and work remotely one day. A member of our recruitment team will provide more details. The IT Third-Party Risk Assessor is responsible for evaluating, monitoring, and reporting on information technology risks associated with third-party vendors, suppliers, service providers, and other external business partners. This role supports the organization's Third-Party Risk Management (TPRM) program by conducting risk assessments, reviewing cybersecurity controls, identifying potential vulnerabilities, and ensuring third parties comply with organizational policies, industry standards, and regulatory requirements. The successful candidate will evaluate the information security and technology frameworks of external partners, SaaS providers, and financial technology associates. This position enforces strict alignment with banking regulations, manages risk lifecycles inside Archer, and leverages AI technologies to accelerate due diligence and continuous monitoring. TPRM SME will partner with business stakeholders, procurement / contract management teams, security teams, compliance functions, and vendors to identify and mitigate risks throughout the third-party lifecycle. Key Responsibilities Third-Party Risk Assessments ul
li Conduct cybersecurity, information security, and technology risk assessments of third-party vendors and service providers. ul
li Review vendor security documentation, including: ul
li SIG questionnaires ul
li SOC 1 and SOC 2 reports (may include Bridge Letter verification) ul
li ISO 27001 certifications to include SoA reviews ul
li Archer Management: Track, document, and manage the end-to-end vendor risk lifecycle within Archer GRC. ul
li AI Tool Integration: Use AI-powered risk platforms to parse vendor documentation and summarize control gaps. ul
li Security policies and procedures ul
li Assess inherent and residual risks associated with third-party relationships. ul
li Evaluate vendor compliance with internal policies, security standards, and regulatory requirements. Risk Analysis and Reporting ul
li Identify and document control gaps, vulnerabilities, and areas of concern. ul
li Develop risk ratings and provide recommendations for risk mitigation. ul
li Prepare concise risk assessment reports and executive-level summaries. ul
li Present assessment findings to business owners, risk committees, and senior management. Ongoing Monitoring ul
li Perform periodic reassessments of critical and high-risk vendors. ul
li Monitor vendors for cybersecurity incidents, financial instability, regulatory actions, and emerging risks. ul
li Track remediation activities and validate corrective actions. ul
li Maintain vendor risk profiles and assessment documentation. Stakeholder Collaboration ul
li Partner with Procurement, Information Security, Legal, Compliance, Privacy, and Business Units throughout the vendor lifecycle. ul
li Provide guidance regarding security requirements during vendor onboarding and renewals. ul
li Support contract reviews by recommending security and data protection requirements. ul
li Assist business partners in understanding and managing third-party technology risks. Governance, Risk, and Compliance ul
li Ensure alignment with regulatory requirements and industry frameworks such as: ul
li NIST Cybersecurity Framework ul
li NIST CRI ul
li NIST 800-53 ul
li NIST 800-171 ul
li FFIEC Guidance ul
li ISO 27001 ul
li HIPAA (as applicable) ul
li Support audits, examinations, and regulatory reviews related to third-party risk. ul
li Contribute to continuous improvements of the Third-Party Risk Management Program. Required Qualifications Education ul
li Bachelor's degree in Information Technology, Information Security, Cybersecurity, Risk Management, Business Administration, or a related field. ul
li Equivalent combination of education and experience will be considered. Experience ul
li 5+ years of experience in: ul
li Third-Party Risk Management (TPRM) ul
li Information Security ul
li Cybersecurity Risk Management ul
li IT Audit ul
li Technology Risk ul
li Operational Risk ul
li Business Continuity Planning ul
li Experience reviewing vendor security assessments and industry-standard assurance reports. ul
li Experience working in regulated industries such as financial services, healthcare, insurance, or technology preferred. ul
li Banking Knowledge: Solid understanding of financial regulatory expectations regarding data protection and operational resilience. Technical Knowledge ul
li Understanding of cybersecurity principles and security control frameworks. ul
li Familiarity with: ul
li Access management ul
li Network security ul
li Cloud security ul
li Data protection and encryption ul
li Disaster recovery and business continuity ul
li Vulnerability management ul
li Incident response ul
li Service Level Management (Agreements review & verification) ul
li Release Management / SDLC ul
li IT Asset Management ul
li IT Configuration Management ul
li Change Management ul
li Problem Management ul
li System Capacity and Performance ul
li Knowledge of vendor risk assessment methodologies and control evaluation techniques. Preferred Certifications One or more of the following certifications are preferred: ul
li Certified Information Systems Security Professional (CISSP) ul
li Certified Information Security Manager (CISM) ul
li Certified Third-Party Risk Professional (CTPRP) ul
li Certified Third Party Risk Assessor (CTPRA) ul
li Certified Information Systems Auditor (CISA) ul
li Certified in Risk and Information Systems Control (CRISC) ul
li Certified Cloud Security Professional (CCSP) ul
li Security+ or equivalent cybersecurity certification Key Competencies ul
li Risk assessment and analysis ul
li Critical thinking and problem solving ul
li TPRM Full Lifecycle ul
li Information security knowledge ul
li Regulatory and compliance awareness ul
li Written and verbal communication ul
li Executive reporting and presentation skills ul
li Attention to detail ul
li Stakeholder relationship management ul
li Time management and organization Success Metrics ul
li Timely completion of third-party risk assessments. ul
li Quality and accuracy of risk evaluations. ul
li Reduction of unresolved vendor control issues. ul
li Effectiveness of remediation tracking and closure. ul
li Compliance with regulatory and internal TPRM requirements. ul
li Positive audit and examination outcomes. ul
li Continuous improvement of third-party risk processes and controls. Reporting Structure Reports To: Head of Data and Financial Operations Transformation Individual Contributor: Yes Travel: Minimal (0-10%) Comp Range: 125k-164k Work Arrangement: Hybrid (based on business needs) This position plays a critical role in protecting the organization from cybersecurity, operational, compliance, and reputational risks arising from third-party relationships while enabling the business to engage vendors safely and effectively.