Third Party Risk Management Lead

This position is part of CNB's Vendor Management Office and is responsible for enterprise wide third party risk evaluations and management services. This role will be a lead role to ensure third party risk assessments are properly conducted, reviewed, and documented. The role will also focus on risk remediation plans and completion. CNB established the Vendor Management Office to support the third party risk management framework.


  • Facilitate third party risk assessments for initial due diligence and ongoing oversight of third party vendor services. This includes collection of documents and analysis, third party risk assessment questionnaire requirements, reviewing audited reports of controls (i.e. SSAE18, SOC Type II, PCI AoC/RoC) and other information to support full evaluation of any potential outsourcing risks.
  • Partner and coordinate closely with internal stakeholder areas (i.e. Information Security,
  • Enterprise Risk Management, Business Continuity Program Office, Credit Administration, and
  • Compliance) to facilitate and evaluate 3rd party service providers.
    Identify, assess and champion remediation efforts/projects for material supplier risks
  • 4Measure progress of supplier risk management activities, including issues tracking and risk remediation efforts, monthly and quarterly status reporting, key supplier metrics and periodic updates to senior business leadership on supplier risks
  • Champion the enterprise Vendor Management purpose throughout the organization; train and advise internal CNB staff on the vendor management processes
  • Provide risk awareness and training to internal staff in support of CNB's Third Party Risk Management Policies and Procedures
  • Escalate issues (delays; significant gaps; uncooperative parties; etc.) to management as required
  • Assist team with prioritization of workload
  • Assist with various ad hoc projects supporting program enhancements, process improvements, and other functions

Basic Qualifications:

  • Minimum of five years of third party risk management, conducting risk assessments, and reporting on KRIs
  • Minimum of four years of experience in risk and controls for information technology and cybersecurity, appropriately scoping assessments, providing credible challenges, and performing assurance testing.
  • Minimum of four years working with a GRC system, incorporating continuous improvement for the system and process

Job Skills and Knowledge:

  • Comprehensive knowledge of third party and information technology risk management processes and methodologies
  • Experience using third party risk management /Governance, Risk and Compliance (GRC) systems
  • Experience assessing contracts, including master service agreements, statements of work, and license agreements.
  • Experience assessing cloud servicing arrangements
    Knowledge of and experience in designing and operating governance, frameworks and processes to comply with vendor management / third party risk management related regulatory requirements, guidance and oversight (OCC 2013-29, Fed SR 13-19 or other relevant third party risk management / vendor management regulation applicable to the financial services industry)
  • Preferred Qualifications
  • Industry recognized third party risk management or vendor management certification
    Six Sigma certification
  • Excellent oral and written communication skills; ability to communicate with all levels of management; experience performing both detailed and executive-level documentation
  • Advanced knowledge of Microsoft Office tools; specifically, Excel, PowerPoint and SharePoint
  • Experience with reporting platforms such as Tableau, SQL scripts, and Microsoft SSRS desirable

Represents basic qualifications for the position. To be considered for this position you must at least meet the basic qualifications.

City National Bank is an Equal Opportunity/Affirmative Action Employer, Minorities/Females/Individuals with Disabilities/Veterans

Note: This preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities, and qualifications required of employees assigned to this job.

Note: Candidates should be advised that City National Bank does not pay interviewee travel expenses or relocation expenses for candidates who are hired unless previously agreed.



Equal Opportunity Employer Minorities/Women/Protected Veterans/Disabled

Back to top