Analyst, Third Party Risk Management
Summary PenFed is hiring an Analyst, Third Party Risk Management in Tysons, VA. The primary purpose of this job is to support the overall management of PenFed’s third party risk program. The TPRM Analyst will serve as a third party risk management liaison to PenFed’s internal lines of business with responsibilities to include, but are not limited to, scheduling, analyzing key service providers, monitoring, and managing on-going third party risk assessments, vendor scorecards, and project management. Essential Functions Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. This is not intended to be an all-inclusive list of job duties and the position will perform other duties as assigned.
- Plan PenFed’s key service providers risk assessments and due diligence reviews designed to achieve engagement objectives involving PenFed’s operational lines third party relationships.
- Perform an analysis of all new relationships as well as the impact of enhancements to the risk profile of existing third party relationships and uses judgement to determine the third party inherent risk and due diligence requirements.
- As a team leader or individual request due diligence documentation for the appropriate risk rating and/or product or service from the PenFed business owner and third party. Upon receipt of requested documentation evaluate for completeness, risk management and control processes are operating as intended and in compliance with applicable laws and regulations. If documentation does not satisfy our requirements, request follow-up documentation as needed.
- Facilitate risk assessment questionnaire and due diligence artifacts to appropriate subject matter experts (SMEs) (e.g. accounting, lending services, compliance, business continuity, and information security). TPRM Analyst may act as an SME for approved compliance and/or financial related reviews. Request business owner to complete third party scorecard and user entity controls, if required by SOC report. Escalate and report any controls weaknesses identified by SMEs to department management.
- Must be able to think analytically and critically to adjust risk assessment ratings, due diligence documentation, and develop mitigation requirements based on the due diligence artifacts and SME specifications. Develops recommendations for management and monitors remediation plans.
- Maintains knowledge of regulatory compliance and assess upcoming regulatory changes for assigned business lines to determine the impact of their third party relationships.
- Develop and maintain working knowledge of third party risk management requirements, regulatory guidance and industry best practices.
- Participate as a third party risk management SME for new key service providers projects to ensure all risks are considered and appropriate level of risk assessment and due diligence is performed. Participate in system demonstrations and facilitates third party client reference check calls.
- Maintain communication with management on identifiable risks and remediation plans.
Education and Experience Equivalent combination of education and experience is considered.
Bachelor’s Degree or equivalent combination of education and related work experience is required.
A minimum of three (3) years’ related financial institution compliance, audit, or third party risk management experience is preferred.
Must be able to demonstrate analytical and critical judgment to adjust documentation and mitigation requirements based on the requirements of each situation.
Comprehensive knowledge of Third Party Risk Management methodologies and regulatory guidance.
Demonstrate ability to work independently in a highly visible position.
Intermediate knowledge of consumer banking laws and regulations (i.e. NCUA, FFIEC, OCC, CFPB, UDAAP) and how they are applied to third party relationships
Proven ability to balance multiple priorities, adapt to constantly changing business environment, work independently, drive projects to completion, and meet deadlines in a fast paced environment.
Strong computer skills, including MS Office products (e.g. Word, Excel, PowerPoint, Visio).
Certified Regulatory Vendor Program Manager (CRVPM) or willing to become certified.
NAFCU’s NCCO designation or willing to obtain certification.