Third Party Due Diligence – Monitoring

Mizuho•New York, NY

4d•$103,000 - $135,000•Hybrid

About The Position

The Assistant Vice President TPDD – Ongoing Monitoring is part of Mizuho Americas’ Third Party Due Diligence team within the Enterprise Controls Department. The role is accountable for the end-to-end execution and quality of continuous monitoring for Critical, High, Moderate, Low, and Nominal third and fourth parties. It identifies, triages, escalates, and resolves monitoring alerts; partners with Third Party Managers, Business Approvers, subject matter experts, Legal, and Compliance to drive remediation; and maintains documentation that is audit-ready and regulator-defensible under the MUSO TPRM Policy, Standard, and Procedure. The role performs ongoing monitoring across cybersecurity and enterprise risk domains, supports portfolio and concentration-risk monitoring, and leads due diligence reviews, reassessments, and significant-change evaluations. It also contributes to reporting, governance, audit readiness, and improvements to monitoring processes and tools. The position works remotely with periodic onsite presence as required; a separate requirement states that office attendance is currently required at least 50% of the time, or five out of every 10 business days. Specific arrangements are communicated during recruitment.

Requirements

Bachelor’s degree in a relevant field such as Information Security, Cybersecurity, Business Administration, Finance, or Risk Management.
At least 5 years of experience in third-party risk management, monitoring, risk assessment, IT audit, or related disciplines within regulated financial services or consulting.
Experience with continuous monitoring platforms such as BitSight, Supply Wisdom, or equivalent, and GRC tools such as Archer or equivalent.
Knowledge of data analysis, contract review, data privacy, information security, information technology, and Business Continuity Planning principles.
Ability to identify, assess, and articulate risks and vulnerabilities, and sound judgment in evaluating control evidence.
Advanced Excel, AI, and analytical skills, with strong attention to detail and accuracy.
Ability to manage priorities, drive issues to closure, and meet regulatory deadlines.
Interpersonal, stakeholder-management, and critical-thinking skills, including the ability to collaborate across the 1LoD, 2LoD, Legal, Compliance, and senior management.
Excellent written and verbal communication skills, including the ability to translate technical risks into clear business language for TPMs, Business Approvers, and executive stakeholders.
Ability to work remotely with periodic onsite presence as required; the posting also specifies a current minimum office-attendance requirement of 50% of the time.

Nice To Haves

Professional certifications such as CTPRP, CTPRA, CISA, CRISC, or CISSP are strongly preferred.
Experience with Shared Assessments and the SIG framework.
Familiarity with U.S. regulatory expectations applicable to TPRM, including FRB SR 13-19, OCC Bulletin 2013-29, NYDFS Part 500, and FFIEC guidance.

Responsibilities

Own ongoing monitoring of third- and fourth-party risks using BitSight and Supply Wisdom, including weekly alert reviews, trend and impact analysis, ransomware and vulnerability assessments, fourth-party incident reporting, and monthly third-party and location license and data reconciliation with heat map analysis.
Evaluate composite risk ratings across macro-economic, financial, geopolitical, infrastructure, business, legal, security and compliance, scalability, and ESG domains.
Coordinate with Cyber Defense to review NCFTA alerts and identify, assess, and respond to emerging high-risk cyber threats affecting Mizuho third parties.
Act as a primary point of contact for TPMs, Business Approvers, Legal, Compliance, CISO/Cyber Defense, DLP, and SMEs on third- and fourth-party risk events and their business impact.
Document material incidents in Archer, including significant score declines, severe fourth-party incidents, sanctions hits, and breaches; communicate impacts in business terms; drive and track remediation to closure; and escalate Critical or High-risk issues as appropriate.
Support monthly concentration and portfolio risk monitoring, contribute to quarterly reporting, and maintain accurate BitSight portfolios and Supply Wisdom license assignments.
Lead and perform due diligence reviews, reassessments, and significant-change evaluations in accordance with TPRM policies and procedures.
Assess inherent risk and control effectiveness across relevant domains; identify and document due diligence gaps and risk exposures; recommend remediation, risk acceptance, or escalation actions in Archer; and coordinate Certificate of Insurance validation as needed.
Review Archer KRI reports for threshold breaches and overdue activities, assess risk impact, drive remediation, escalate issues, and ensure risk acceptances are recorded and tracked.
Support internal and external audits, regulatory exams, and Federal Banking Agency Report of Examination reviews through timely, accurate documentation; maintain audit-ready records and conduct QA reviews of 10% of Moderate/Low and 100% of Critical/High assessments.
Contribute to improvements to IRQs, DDQs, monitoring playbooks, KRIs, and reporting processes; identify and remediate Archer data anomalies; support reconciliations across Archer, SNOW, Supply Wisdom, and BitSight; and deliver monitoring activities in line with TPRM objectives and regulatory requirements.