Third Party Risk Manager

As Mercury prepares to become a bank, our Third Party Risk Management (TPRM) program is in active development to meet bank-level regulatory expectations. As an early member of a growing TPRM team, you’ll help run the program day-to-day and contribute how it matures, bringing your own judgment and point of view to a function that is usually more rigidly defined, with room to be creative and make your mark.

As a Third Party Risk Manager, you’ll help protect Mercury, our customers, and the broader financial ecosystem from the risks that come with relying on third parties. Reporting to the Senior Manager, Third Party Risk Management, you’ll complete third-party risk assessments, support risk reporting, and provide second-line oversight.

Key Responsibilities:

• Assess and risk rate: Complete third-party risk assessments, risk rate third parties, and open and track issues through resolution.
• Second-line oversight: Review and challenge first-line due diligence and ongoing monitoring, including reporting, approvals and oversight of those activities. First-line owners remain accountable for managing the third-party relationship, including SLAs, business reviews, exit strategies and onboarding.
• Reporting and data: Support maintenance of third party risk reporting and metrics for management and governance forums, and help keep the underlying data accurate.
• Tooling and automation: Help implement tooling and automation to make processes more efficient.
• Program uplift: Support and contribute to uplift efforts across the TPRM program, including updates to policies, due diligence, risk assessment processes, and risk management across the third party lifecycle.

Required Qualifications:

• 4+ years of third party risk management experience, including 2+ years in a regulated financial services environment (bank, or fintech working with bank partners).
• Working knowledge of regulatory guidance on third party risk, including the Interagency Guidance on Third Party Relationships (and related FFIEC, OCC and FDIC expectations), and TPRM industry practices across the third party lifecycle (planning, due diligence, contracting, monitoring, termination).
• Hands-on experience completing third party risk assessments across multiple risk domains, not only security.
• Experience reviewing and challenging first-line risk work with evidence-based pushback.
• Experience supporting audits or exams of a TPRM program (gathering evidence, responding to requests, following up on findings).
• Experience building or maintaining TPRM reporting and metrics, with attention to data accuracy.
• Solid program and project management skills, with experience supporting a program that spans multiple cross-functional components and driving process improvements through to implementation.
• Proven ability to influence cross-functional partners (Procurement, Finance, InfoSec, Legal, Privacy) without direct authority.
• Clear communicator who can explain a risk position and hold it under pushback.