Third Party Risk Governance

The role will support the Bank's second line of defense responsibilities and play a key role in overseeing third-party risk governance, regulatory compliance, vendor risk assessments, ongoing monitoring, issue remediation tracking, and management risk reporting etc. Please find below the proposed role requirements in detailed:-

Experience

• Minimum 5+ years of relevant experience in Third-Party Risk Management, Vendor Governance, Information Security Risk, Operational Risk, or Internal Audit.
• Prior experience in Banking, Financial Services, FinTech, or regulated environments preferred.

Key Responsibilities

• Manage and enhance the TPRM framework, policies, standards, and governance processes.
• Oversee the end-to-end third-party lifecycle, spanning vendor discovery, due diligence, risk scoring, contract risk clauses, ongoing monitoring, and offboarding/termination.
• Maintain an accurate, centralized repository of all third-party vendors, critical suppliers, and fourth party (subcontractor) dependencies oversight.
• Conduct independent risk assessments for vendors across cyber security, data privacy, operational resilience, financial stability, regulatory compliance, and business continuity domains.
• Review outsourcing & critical vendor arrangements and ensure compliance with applicable regulatory requirements.
• Coordinate with Procurement, Legal, Information Security or CISO, Compliance, and Business Teams for risk evaluations and contract governance i.e, SLA, incident etc.
• Manage third-party incidents, escalations, exception approvals, and vendor offboarding activities
• Support audits, regulatory examinations, management reporting, and governance committee updates.
• Review and manage risk acceptance requests or policy deviations, ensuring proper escalation to senior management or risk committees when high-risk tolerance thresholds are breached.
• Track identified vendor vulnerabilities, audit findings, or compliance gaps to closure, working closely with vendor relationship managers in the first line.
• Collaborate with business unit vendor owners to monitor key performance indicators (KPIs) and service-level agreements (SLAs).

Preferred Qualifications

• Bachelor's degree in Business Administration, Risk Management, Cybersecurity or related field.
• Professional certifications such as CRISC, CISA, CISSP, CTPRP, or equivalent would be an added advantage.
• Hands-on experience with GRC/TPRM platforms such as Archer, ServiceNow or similar GRC tools.
• Strong understanding of RBI Outsourcing Guidelines, Operational Risk Management, Information Security, ISO 27001, NIST, SOC reports, and regulatory compliance frameworks.

Key Competencies

• Strong analytical and risk assessment capabilities.
• Effective stakeholder management and communication skills.
• Ability to independently manage multiple assessments and governance activities.
• Experience in presenting risk insights and remediation status to senior management and governance forums.