Third Party Risk Management Manager Jobs

About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career. About Third Party Risk The Third Party Risk Management (TPRM) team is accountable for defining, maintaining, and overseeing the third party risk framework, policy, and inventory in accordance with management expectations and best practices. We are focused on assessing and managing risks exposed through our relationships with third parties, adhering to regulatory guidance, and driving operational efficiencies across risk teams. TPRM is a regulatory obligation for Financial Services companies. What you’ll do We're looking for a Third Party Risk Analyst to join our growing team. This individual will support the ongoing operations of the existing framework for identifying, assessing, and managing third party risks to protect Stripe. Responsibilities Conduct third party assessments while facilitating the process through closure. Conduct risk domain reviews owned by TPRM including reputation, financial, anti-bribery and corruption, and sanctions risk. Responsible for the integrity and maintenance of the third party risk inventory including reconciliation to other internal data sets. Prepare and continuously improve third party risk reporting for senior leaders, relevant stakeholders, and governance groups. Partner with the US TPRM team to drive execution and delivery of required procedures to maintain ongoing regulatory compliance operations for programs including the Digital Operational Resilience Act (DORA) and global outsourcing regimes. Work closely with in

At Vanta, our mission is to help businesses earn and prove trust. We believe that security should be monitored and verified continuously, and we empower companies to practice better security and prove it with ease. Vanta has a kind and talented team, and while some have prior security experience, many have been successful at Vanta without it. We believe that security should be monitored and verified continuously, including the security of your supply chain. The Vendor Risk Management (VRM) product was designed to provide software buyers with tools to evaluate the security of their vendors by inventorying vendors, prioritizing risks, automating security reviews and remediating findings. VRM or Third party Risk Management (TPRM) presents a massive opportunity for Vanta - representing a market of $5-$10B in ARR and a CAGR of 10.8% driven by secular tailwinds in the industry that requires more focussed and deeper scrutiny of the company’s supply chain. As a Senior Software Engineer with full stack focus, you’ll be responsible for driving complex projects across our technical stack and mentor our talented engineering team. Your past experience will be leveraged to accelerate the evolution of our Vendor Risk Management product and help software buyers continuously and comprehensively monitor risks across their vendor supply chain. Our business has found incredible product-market fit and has monetized effectively since the day we signed our first customer. We’re growing at a blistering pace, which presents career-defining opportunities for engineers to accelerate their growth and to contribute to a rapidly-scaling company. Vanta has a kind and talented team, and while some have prior security experience, many have been successful at Vanta without it. We’d love for you to join us! Visit our Vanta Engineering Blog to learn more about what our team is working on! What you’ll do as a Senior Software Engineer at Vanta: Lead complex, ambiguous projects end-to-end, partnering wit

At Freddie Mac, our mission of Making Home Possible is what motivates us, and it’s at the core of everything we do. Since our charter in 1970, we have made home possible for more than 90 million families across the country. Join an organization where your work contributes to a greater purpose. Position Overview: At Freddie Mac, our mission of Making Home Possible is what motivates us, and it’s at the core of everything we do. Since our charter in 1970, we have made home possible for more than 90 million families across the country. Join an organization where your work contributes to a greater purpose. This role is in Governance and Business Services (GBS) and is part of 1st Line within the Multifamily Division at Freddie Mac in McLean, VA. GBS leads the division in managing operational risk, in compliance with the Corporate Enterprise Risk Management framework. As an Operational Risk & Controls Senior in GBS, you will support Multifamily Process Owners in managing third-party supplier risk by using an integrated approach to operational risk frameworks, collaborating with the 2nd line, 3rd line, and other business lines counterparts. You will engage with key business process owners to assess and monitor inherent risks associated with suppliers, ensuring compliance with regulatory standards and internal controls. This role also offers an excellent opportunity to gain insight into our Multifamily business. The responsibilities are time-sensitive and carry a high level of visibility both within the Multifamily division and across the company. Our Impact: Our team leads third-party risk management for the Multifamily division, serving as trusted advisors to business process owners. We ensure compliance with all corporate third-party risk policies, standards, and procedures, and proactively partner with stakeholders across all three lines to assess and mitigate supplier risks. We oversee

At Asana, security is foundational to our mission of helping teams work together effortlessly. Our security team protects Asana’s employees, users, and customers by proactively addressing threats, ensuring compliance with legal and regulatory requirements, and fostering a culture of security throughout our product and operations. We are a team of security engineers and risk and compliance practitioners who build innovative safeguards and collaborate across the organization to build and maintain trust at scale. As the Third Party Risk Management Lead, you will be responsible for building and running Asana’s Third Party Risk Management (TPRM) program. You will own the end-to-end lifecycle of vendor security risk — from initial due diligence and risk tiering through ongoing monitoring and remediation. You will work closely with Procurement, Legal, Privacy, and Engineering teams to ensure that our third-party relationships are effectively assessed, tracked, and managed. This role is based in our Warsaw office with an office-centric hybrid schedule. The standard in-office days are Monday, Tuesday, and Thursday. Most Asanas have the option to work from home on Wednesdays. Working from home on Fridays depends on the type of work you do, and your recruiter can share more about the in-office requirements. Our employees in Poland are employed under a contract of employment. What you’ll achieve Own and scale Asana’s TPRM program: Design, implement, and continuously improve a risk-based framework for assessing and managing third-party vendors and service providers. Establish risk tiering criteria, assessment workflows, and governance processes that scale with business growth. Lead vendor security assessments: Conduct and oversee security due diligence for new and existing vendors, including reviewing SOC 2 reports, ISO 27001 certifications, security questionnaires (SIG, CAIQ), and other relevant documentation. Identify gaps and work with vendors to remediate findings. Drive rem

Lithic is the modern card issuing and processing platform empowering ambitious financial companies to build the future of payments. Our infrastructure powers card programs for 100+ innovative clients, from fintechs reimagining credit and digital banking to platforms transforming disbursements and spend management. Companies like Mercury, Flex, and Novo rely on Lithic's developer-friendly APIs, direct network connections, and flawless reconciliation to launch and scale card programs in weeks, not years. We're building a future where access to better financial products materially improves people's lives, free from the constraints of 30-year-old mainframes and legacy processors. We're proud to be backed by world-class investors who share that vision, including Bessemer Venture Partners, Index Ventures, Spark Capital, Stripes, and Mastercard, along with many others. We're a team of 170+ across 26 states and 7 countries, headquartered in New York City. We are hiring a Senior Risk Associate to run Lithic's risk assessment function: the client risk assessment program, the third party risk management program, and the enterprise risk assessment. You will execute the assessments, own the operations that keep them on schedule and defensible, and continuously improve the rubrics, questionnaires, registers, and SOPs that govern them. You will also own program underwriting: the criteria, limit and reserve recommendations, and periodic reassessment that follow a client from diligence through scale. This is an AI-forward role. Lithic is deploying agentic tooling across diligence and documentation workflows, and this role owns that build in the assessment domain: testing, tuning, and documenting the tooling so routine collection, review, and drafting are absorbed by automation, while you own the judgment calls, the exceptions, and the written product that goes to partner banks and examiners. This role operates with limited guidance and owns its programs end to end. It is

About the Role: We are seeking an experienced Risk Management professional to lead and strengthen the organisation's Operational Risk and Outsourcing Risk Management framework. The role will be responsible for identifying, assessing, monitoring, and mitigating operational and third-party risks across payment products, merchant acquiring, cross-border payments, and outsourced business operations. The incumbent will work closely with business, operations, compliance, technology, audit, and leadership teams to ensure adherence to regulatory requirements, network guidelines, and internal risk policies. Key Responsibilities Operational Risk Management: Develop, implement, and enhance the Operational Risk Management (ORM) framework, including Risk and Control Self-Assessments (RCSAs), across the organisation. Identify, assess, monitor, and mitigate operational risks arising from payment operations, merchant onboarding, transaction processing, and customer servicing. Drive corrective action plans arising from RCSA findings and control gaps. Monitor Key Risk Indicators (KRIs), operational losses, incidents, and control effectiveness. Lead root cause analysis and remediation for operational risk events. Own SOP and policy lifecycle management — including drafting, versioning, and periodic review — for all operational risk policies and procedures. Outsourcing Risk Management: Manage end-to-end outsourcing risk governance for third-party vendors involved in KYC verification, PAN validation, customer onboarding, payment processing, and other critical functions. Maintain and operate a vendor categorisation framework (IT/Non-IT, critical/non-critical outsourcing) and ensure risk assessments are calibrated to vendor tier and exposure. Ensure compliance with RBI Outsourcing Guidelines, PA Master Directions 2025, and all applicable regulatory requirements. Conduct vendor due diligence, risk assessments, performance reviews, and periodic audits. Monitor SLA adherence, control ef

At Vanta, our mission is to help businesses earn and prove trust. We believe that security should be monitored and verified continuously, and we empower companies to practice better security and prove it with ease. Vanta has a kind and talented team, and while some have prior security experience, many have been successful at Vanta without it. As one of Vanta’s GTM-facing GRC Subject Matter Experts, you will be a highly visible, customer-facing leader within Vanta’s Security team, responsible for representing Vanta’s Trust Management Platform to prospects and customers, as well as having a role in collaborating with internal teams to help drive and implement new features in the product. This role is specifically involved with Vanta's pre-sales and marketing motions, owning GRC conversations for net-new prospects and the expansion of existing customers' use of the Vanta product, as well as supporting marketing efforts by representing Vanta in public-facing conversations and speaking engagements. If this sounds like you, and you're excited to use your Security, Privacy, and broader GRC experience to help grow and sell our product, we'd love to hear from you. Candidates must be based in Pacific, Mountain, or Central time zones for this role. What you’ll do as a Governance, Risk, and Compliance Expert, GTM at Vanta: Partner with Vanta's Sales, Account Management, and Solutions Engineering teams and own GRC-focused discussions & activities, representing Vanta’s Trust Management Platform to prospects/customers. Become an expert in Vanta’s product features to translate how they can help optimize prospect/customer GRC workflows. Engage with executives and senior staff at prospect and customer organizations to establish relationships with customer security, privacy, and AI teams. Answer questions from internal and external stakeholders on GRC programs, including program foundation/scaling strategies, framework-specific requirements, third-party risk management, and broade

Block is one company built from many blocks, all united by the same purpose of economic empowerment. The blocks that form our foundational teams — People, Finance, Counsel, Hardware, Information Security, Platform Infrastructure Engineering, and more — provide support and guidance at the corporate level. They work across business groups and around the globe, spanning time zones and disciplines to develop inclusive People policies, forecast finances, give legal counsel, safeguard systems, nurture new initiatives, and more. Every challenge creates possibilities, and we need different perspectives to see them all. Bring yours to Block. The Role Square Financial Services, Inc. (SFS) is Block’s bank. We opened in March 2021 and provide lending and FDIC-insured deposit products to individuals and small businesses on a nationwide basis. SFS Risk Management is scaling vendor security, third party risk, and business continuity through innovation. Our Risk team designs and promotes the frameworks, standards, and oversight that elevates security considerations among our vendors, simplifies our regulatory obligations, and ensures resilience in our business operations. The team also operates the agent-first platforms that turn those frameworks into running systems. Most of governance is a data problem. The risk, control, and asset information needed to answer "are we secure and compliant?" is dispersed across dozens of systems: Security Engineers treat that as an engineering problem. You'll build the data pipelines, integrations, and agentic AI workflows that turn manual governance processes into products that run continuously, produce measurable results, and hold up to audit end to end. You Will Own and operationalize a SFS third-party risk management and business continuity program program. Define the technical approach for ambiguous, cross-team problem spaces. This is an early-stage program, and you will frame problems as often as you solve them. Build and operate the p

Senior TPRM Consultant (Partner Engagements) Location: 1540 Broadway, New York, NY 10036 Department: Corporate Controllership – Third-Party Risk Management (TPRM) Reports to: Director of Third-Party Risk Governance & Awareness Position Summary: The Senior TPRM Consultant is responsible for supporting the development and management of the TPRM Program framework, specifically for the sales partner ecosystem (e.g., solution partners, system integrators, resellers and distributors). This role sits at the intersection of risk management, sales, legal, and sales operations — and requires someone who can independently drive risk conversations forward , not simply administer a process. Success in this role depends on your ability to lead — setting the agenda, holding partners and internal stakeholders accountable to timelines, and driving issues to closure. The role supports the design, maintenance, and enforcement of TPRM policy, standards, and governance. In close partnership with risk domain leads and cross-functional stakeholders, this role helps advance program maturity, support regulatory alignment, and strengthen third-party risk practices across the enterprise. Key Responsibilities: Manage the TPRM governance committees, including preparing materials and strategizing focused agendas that drive risk identification, mitigation, and oversight. Set the TPRM governance framework by defining roles and responsibilities to ensure appropriate oversight of third-party engagements and manage associated risks; and enhancing risk treatment / risk acceptance processes. Determine and establish program metrics, including key performance and risk indicators (KPIs/KRIs) to enable effective oversight of the TPRM program. Maintain TPRM policies, procedures, and governance documentation to reflect regulatory changes and evolving industry standar

Job Title: PMO - Third Party Risk Management (TPRM) About Us “Capco, a Wipro company, is a global technology and management consulting firm. Awarded with Consultancy of the year in the British Bank Award and has been ranked Top 100 Best Companies for Women in India 2022 by Avtar & Seramount . With our presence across 32 cities across globe, we support 100+ clients across banking, financial and Energy sectors. We are recognized for our deep transformation execution and delivery. WHY JOIN CAPCO? You will work on engaging projects with the largest international and local banks, insurance companies, payment service providers and other key players in the industry. The projects that will transform the financial services industry. MAKE AN IMPACT Innovative thinking, delivery excellence and thought leadership to help our clients transform their business. Together with our clients and industry partners, we deliver disruptive work that is changing energy and financial services. #BEYOURSELFATWORK Capco has a tolerant, open culture that values diversity, inclusivity, and creativity. CAREER ADVANCEMENT With no forced hierarchy at Capco, everyone has the opportunity to grow as we grow, taking their career into their own hands. DIVERSITY & INCLUSION We believe that diversity of people and perspective gives us a competitive advantage. Risk Uplift & Remediation (TPRM Programme) The PMO Support resource will provide project coordination, governance, and reporting support to the Risk Uplift & Remediation workstream within the Third-Party Risk Management (TPRM) programme. The role will help ensure effective planning, tracking, and delivery of workstream activities, while maintaining alignment with programme governance standards and reporting requirements. Working closely with the Workstream Lead and wider programme team, the successful candidate will support the management of project plans, RAID logs, action trackers, dependencies, and gove

About the role As a Senior Business Analyst, TPRM, you will support the assessment and ongoing oversight of third party relationships, including vendors and partners, throughout the third party risk management lifecycle. You will assess third party risk, conduct business due diligence, and coordinate additional risk assessments with cross-functional partners. You will help ensure risks are appropriately identified, documented, and addressed while working closely with business owners, risk partners, and Chime’s bank partners. This role requires strong analytical judgment, attention to detail, and the ability to manage multiple assessments and stakeholders. You will serve as a trusted partner to the business while contributing to the continued development and maturity of Chime’s TPRM program. In this role, you can expect to Review and challenge Inherent Risk Questionnaires (IRQs), working with business owners to understand vendor relationships, validate information, and determine appropriate inherent risk and criticality ratings. Coordinate due diligence activities with cross-functional risk partners and subject matter experts across areas such as Information Security, Privacy, Compliance, Enterprise Risk Management, and Legal. Conduct business due diligence, including reviews of corporate registration, reputational information, insurance coverage, and other relevant documentation, and coordinate additional activities such as background checks. Manage assigned third party assessments through completion, coordinating with business owners and cross-functional risk partners to address questions, follow up on outstanding requirements, and escalate concerns as appropriate. Facilitate vendor approval processes with Chime’s bank partners, including coordinating assessment information, responding to follow-up requests, and tracking approvals through completion. Identify and document issues arising from TPRM assessments and partner with relevant stakeholders to track third par

About the role We are seeking an experienced and detail-oriented Information Security and Cloud Security Auditor to join our team. The ideal candidate will have 3-7 years of expertise in data security and privacy control implementation, internal auditing, third-party risk management, cybersecurity governance, and cloud security (banking sector preferred). This role will be responsible for conducting comprehensive IT and cloud security audits, ensuring compliance with regulatory requirements, and enhancing our information security policies and procedures. Key Responsibilities -Conduct IT and cloud security audits across various domains, including IT General Controls (ITGC), Information Security Controls, Cloud Security, Network Security, Vulnerability Management, and Vendor Risk Assessments. -Assess compliance with relevant laws, regulations, industry standards, and organizational policies across both on-premises and cloud environments. -Develop and enhance information security and cloud security policies and procedures in alignment with industry best practices. -Maintain thorough documentation of audit findings, risk assessments, security measures, working papers, audit program checklists, and evidence for internal and external reporting. -Validate ITGC, cloud security, and application-specific controls and manage audit documentation, risk assessments, evidence gathering, and control testing. -Follow up on audit findings and ensure timely closure of non-compliance and security issues identified during audits. -Manage and oversee third-party risk assessments and audits, ensuring robust security controls are implemented across traditional and cloud-based service providers. -Lead and participate in the development, migration, and implementation of security controls and policies for network and cloud security solutions. -Conduct risk-based security assessments of internal, vendor, and third-party hosted environments, covering both traditional IT infrastructure and cloud

Role Overview You’re a hands-on backend engineer who enjoys owning features end to end and working on real products that customers rely on every day. In this Software Engineer II role, you’ll help build and evolve a Third Party Risk Management SaaS platform using Laravel and PHP, designing scalable APIs and services that keep performance and reliability front and center. You’ll work in a product-focused team that owns its services from architecture and implementation through deployment, monitoring, and continuous improvement. You’ll mentor junior engineers, influence technical decisions, and use modern AI-powered tools thoughtfully to ship better code faster. If you’re looking for a mid-level role with real ownership, modern tooling, and the chance to grow your impact, this is for you. Here’s a breakdown of what you’ll do (not all of it, just the important stuff) Design, build, and maintain backend features and RESTful APIs in Laravel within a modern TALL stack environment. Own well-defined stories from implementation through deployment, monitoring, and iteration, ensuring performance and reliability. Contribute to architectural discussions and technical decisions that shape the Third Party Risk Management platform. Review code, improve test coverage, and strengthen CI/CD and engineering standards across the team. Mentor Software Engineer I colleagues through code reviews, pairing, and knowledge sharing. Use AI tools (e.g. GitHub Copilot, ChatGPT) to accelerate coding, debugging, testing, and documentation—while critically validating outputs and ensuring safe, responsible use. These are the essentials you’ll need to get an interview 3–5 years of professional software engineering experience in an agile, fast-paced environment. Strong experience with PHP and Laravel, ideally within the TALL stack (Tailwind, Alpine.js, Laravel, Livewire). Solid understanding of relational databases (MySQL or MariaDB), including data modelling and query optimisation. Experience designin

About the Role As our Digital Trust and Resilience Engineer, you will lead and perform technology risk assessment and security compliance activities central to our global operations. You will coordinate annual IT internal and external audit programs, including ISO and SOC 2 certifications across our key markets. These certifications are critical to accelerating customer onboarding and streamlining annual regulatory audits worldwide. You will also run mandatory employee security awareness training globally, and drive the automation of evidence collection to improve efficiency. In this role, you will identify compliance gaps, support remediations, and provide technical guidance across all business units. AI is fundamental to how we work. In this position, you will help us build AI automations, workflows, and agents to boost the efficiency of Digital Trust & Resilience operations. You do not need to be an AI researcher. You just need to understand compliance risks and have a drive to learn and apply AI tools. Responsibilities: Coordinate and perform annual IT internal audits and external audits for ISO and SOC 2 certifications across global markets, ensuring certifications are maintained to support customer and partner onboarding and regulatory audit readiness Run global, regulator-mandated employee security awareness and compliance training campaigns, including tracking, reporting, and continuous improvement Automate evidence collection and compliance workflows to drive efficiency gains and scale operations in response to growing regulatory demands Participate in internal security and privacy assessments, external audits, compliance certifications, and risk management activities Provide complete and accurate responses to internal and third-party enquiries on security compliance Perform periodic technical, organizational, and third-party risk and control assessments, and manage remediation activities to complet

About the Role As our Digital Trust and Resilience Specialist you will lead and perform technology risk assessment and security compliance activities central to our global operations. You will coordinate annual IT internal and external audit programs, including ISO and SOC 2 certifications across our key markets. These certifications are critical to accelerating customer onboarding and streamlining annual regulatory audits worldwide. You will also run mandatory employee security awareness training globally, and drive the automation of evidence collection to improve efficiency. In this role, you will identify compliance gaps, support remediations, and provide technical guidance across all business units. AI is fundamental to how we work. In this position, you will help us build AI automations, workflows, and agents to boost the efficiency of Digital Trust & Resilience operations. You do not need to be an AI researcher. You just need to understand compliance risks and have a drive to learn and apply AI tools. Responsibilities: Coordinate and perform annual IT internal audits and external audits for ISO and SOC 2 certifications across global markets, ensuring certifications are maintained to support customer and partner onboarding and regulatory audit readiness Run global, regulator-mandated employee security awareness and compliance training campaigns, including tracking, reporting, and continuous improvement Automate evidence collection and compliance workflows to drive efficiency gains and scale operations in response to growing regulatory demands Participate in internal security and privacy assessments, external audits, compliance certifications, and risk management activities Provide complete and accurate responses to internal and third-party enquiries on security compliance Perform periodic technical, organizational, and third-party risk and control assessments, and manage remediation activities to completi