Vendor Risk Management Officer

Banco Sabadell is seeking a Vendor Risk Management Officer candidate to join a dynamic team within one of the fastest growing banks in Florida.

Essential Duties and Responsibilities
• VRM Program Execution and Governance
• Execute the day-to-day requirements, procedures, workflows, and control activities of the Vendor Risk Management program under the direction of the CISO.
• Serve as the day-to-day liaison with the Head Office VRM Department for program expectations, reporting, methodology alignment, and issue escalation.
• Maintain and improve the VRM calendar covering onboarding, periodic reviews, VMOR activities, risk reassessments, committee deliverables, audit requests, and reporting deadlines.
• Track program obligations, follow up with accountable parties, document completion, and escalate delays or material issues.
• Analyze control gaps, process efficiency, and risk trends and recommend program improvements to the CISO; management retains approval of policy changes, exceptions, and risk acceptance.
• Vendor Onboarding and Due Diligence
• Coordinate new-vendor onboarding through the Bank's approved VRM workflow tool, currently Venminder/NContracts, or any successor platform.
• Work with business owners and subject-matter experts to obtain information-security, business-continuity, privacy, compliance, financial, operational, and contractual due diligence.
• Review submissions for completeness and consistency and drive follow-up with business owners, vendors, and internal reviewers.
• Perform or coordinate inherent-risk assessments, risk tiering, and control reviews based on vendor criticality, data exposure, regulatory impact, service dependency, and scope.
• Confirm required approvals are documented before onboarding or renewal and escalate unresolved findings, exceptions, or residual-risk decisions to the appropriate approver.
• Periodic Reviews, VMOR, and Ongoing Monitoring
• Coordinate the annual VMOR process with business owners, risk contributors, and control partners.
• Complete periodic reviews to confirm vendor use remains consistent with the executed agreement, approved service scope, risk rating, and control expectations.
• Prepare and maintain User Consideration Forms or equivalent evidence of ongoing review and oversight.
• Monitor vendor alerts, risk intelligence, service changes, control issues, contract expirations, and other reassessment triggers.
• Track remediation plans, findings, risk acceptances, exceptions, and overdue actions through closure; escalate aging, high-risk, or disputed items to the CISO and relevant governance forum.
• Audit, Regulatory, and Evidence Management
• Support internal audit, external audit, regulatory, and Head Office requests concerning VRM and third-party oversight.
• Maintain complete, organized, and audit-ready evidence for onboarding, due diligence, contracts, periodic reviews, control assessments, approvals, risk decisions, and remediation.
• Coordinate evidence collection with business owners, Operational Risk Management, Financial Risk Management, Information Security, Procurement, Legal, Compliance, and other stakeholders.
• Identify recurring findings, documentation gaps, and process weaknesses and recommend corrective actions to the CISO.
• Prepare status updates, draft management responses, and supporting materials for VRM observations, issue tracking, and closure validation, subject to management review.
• DORA, Concentration Risk, and Exit Strategy Planning
• Coordinate with Head Office to support DORA-aligned third-party ICT risk requirements, including identification of vendors supporting critical, important, or essential business services.
• Collect, validate, and maintain vendor-dependency data used to assess concentration risk across vendors, services, business lines, legal entities, geographies, technology platforms, and subcontracting chains.
• Support Operational Risk Management, Financial Risk Management, Information Security, business owners, and Head Office in evaluating reliance on single providers, connected providers, and non-substitutable ICT services.
• Maintain documentation of concentration-risk assumptions, data sources, methodology, management review, risk acceptance, and escalation of high-concentration scenarios.
• Coordinate annual exit-strategy tabletop exercises for essential vendors, including scenario preparation, participants, evidence, lessons learned, action tracking, and reporting.
• Support updates to vendor exit and transition plans so they remain operationally credible and address business continuity, data portability, service substitution, and orderly termination.
• Contracts, Reporting, and Stakeholder Coordination
• Confirm vendor contracts are current, fully executed, retained in the appropriate repository, and aligned with the approved service scope and risk classification; refer legal interpretation to Legal.
• Maintain complete records of contracts, due diligence, risk assessments, oversight, approvals, exceptions, and remediation evidence.
• Prepare accurate VRM reports, dashboards, presentations, metrics, and executive summaries for the CISO, committees, audits, Head Office, and other governance forums.
• Coordinate inputs with Operational Risk Management and Financial Risk Management and help ensure vendor risks are reflected consistently across applicable risk processes.
• Facilitate communication among business owners, vendors, control partners, and management to complete assessments, approvals, remediation, and reporting on time.
• Support related control activities assigned by the CISO, including the Clean Desk test and other governance, compliance, or risk-awareness activities.

Minimum Qualifications
• Bachelor's degree or equivalent relevant professional experience.
• 3-5 years of experience in Vendor Risk Management, third-party risk, Risk Management, Compliance, Information Security/GRC, Operational Risk, Internal Audit, Procurement risk, or a related control function; financial-services experience is preferred.
• Direct VRM or third-party due-diligence experience is preferred. Candidates from other Risk and Compliance disciplines will be considered when they demonstrate transferable experience in risk assessment, control testing, issue management, regulatory/audit support, and stakeholder coordination.
• Experience coordinating multiple workstreams, maintaining audit-ready documentation, and escalating material risks or overdue actions.
• Familiarity with financial-institution third-party-risk expectations, DORA, concentration risk, and vendor exit planning is preferred; equivalent relevant regulatory experience is acceptable.
• Professional certification such as CTPRP, CRVPM, CISA, CRISC, CRCM, or a comparable risk/compliance credential is a plus, not required.
• Ability to speak, write and read English and Spanish fluently (required)