Vendor Risk Manager

Key Responsibilities

Skills, Knowledge & Expertise

Responsibilities

• Due Diligence & Onboarding
• Run due diligence on new vendors before contracts are signed, including financial health checks, SOC 2 / ISO 27001 review, breach history, and subprocessor mapping.
• Issue a clear risk rating for every prospective vendor, with conditions attached rather than a simple pass or fail, covering KYC, identity verification, fraud detection, credit bureau, payment processing, card issuing, banking, and collections partners.
• Sit inside the contracting process with Legal and Procurement to secure the terms that matter: audit rights, breach notification windows, data localization commitments, exit assistance clauses, and SLAs tied to real penalties.
• Risk Assessment & Ongoing Monitoring
• Own vendor risk assessments across our active third-party portfolio, prioritizing critical and high-risk vendors for annual deep-dive reviews.
• Build and run tiered monitoring cadences — quarterly for critical vendors such as KYC, payment processing, and banking partners, annual for the rest — tracking control drift, subprocessor changes, and adverse media.
• Maintain the concentration risk and critical-vendor register, and be ready to explain single points of failure, such as one bureau covering the majority of underwriting volume, and what the contingency plan actually is.
• Cross-Functional Partnership
• Work with Product before new vendor integrations go live — you're in the room when a new checkout partner or fraud model vendor is being evaluated, not brought in after the contract is signed. • Prepare vendor risk reporting for the Risk Committee and Board, translating control gaps and incident trends into decisions leadership can act on.
• Offboarding & Exit Management
• Manage the offboarding process for exited vendors, confirming data deletion, access revocation, and transition continuity for anything customer-facing.
• Ensure regulatory and contractual exit obligations are met and documented, particularly for vendors classified as critical or important.
• Due Diligence & Onboarding - Run due diligence on new vendors before contracts are signed, including financial health checks, SOC 2 / ISO 27001 review, breach history, and subprocessor mapping. - Issue a clear risk rating for every prospective vendor, with conditions attached rather than a simple pass or fail, covering KYC, identity verification, fraud detection, credit bureau, payment processing, card issuing, banking, and collections partners. - Sit inside the contracting process with Legal and Procurement to secure the terms that matter: audit rights, breach notification windows, data localization commitments, exit assistance clauses, and SLAs tied to real penalties. Risk Assessment & Ongoing Monitoring - Own vendor risk assessments across our active third-party portfolio, prioritizing critical and high-risk vendors for annual deep-dive reviews. - Build and run tiered monitoring cadences — quarterly for critical vendors such as KYC, payment processing, and banking partners, annual for the rest — tracking control drift, subprocessor changes, and adverse media. - Maintain the concentration risk and critical-vendor register, and be ready to explain single points of failure, such as one bureau covering the majority of underwriting volume, and what the contingency plan actually is. Cross-Functional Partnership - Work with Product before new vendor integrations go live — you're in the room when a new checkout partner or fraud model vendor is being evaluated, not brought in after the contract is signed. • Prepare vendor risk reporting for the Risk Committee and Board, translating control gaps and incident trends into decisions leadership can act on. Offboarding & Exit Management - Manage the offboarding process for exited vendors, confirming data deletion, access revocation, and transition continuity for anything customer-facing. - Ensure regulatory and contractual exit obligations are met and documented, particularly for vendors classified as critical or important.