Third Party Due Diligence – Monitoring

Mizuho•New York City, NY

3d•$103,000 - $135,000•Hybrid

About The Position

The Assistant Vice President of Third Party Due Diligence (TPDD) – Ongoing Monitoring is accountable for executing and maintaining the quality of the continuous monitoring program for Critical, High, Moderate, Low, and Nominal third and fourth parties. The role manages the identification, triage, escalation, and resolution of monitoring alerts and partners with Third Party Managers, Business Approvers, subject matter experts, Legal, and Compliance to drive remediation. Monitoring activity must be documented in an audit-ready, regulator-defensible manner consistent with Mizuho’s TPRM Policy, Standard, and Procedure. The position sits within the Mizuho Americas Enterprise Controls Department, a first-line risk and control function, and the Third Party Risk Management Unit. The TPDD team evaluates third-party service providers across information security, information technology, business continuity planning, and adjacent domains, and monitors third- and fourth-party risks and events. The role uses tools including BitSight, Supply Wisdom, NCFTA intelligence feeds, and Archer. The expected base salary is $103,000–$135,000. Salary offers consider relevant skills, training, experience, education, certifications, licenses, and market and organizational factors. The position also offers an employee benefits package, including medical, dental, and 401(k) benefits beginning on the first day of employment, and eligibility for a discretionary bonus. In-office attendance is currently required at least 50% of the time, or five out of every ten business days; role-specific details will be communicated during recruitment.

Requirements

Bachelor’s degree in a relevant field, such as Information Security, Cybersecurity, Business Administration, Finance, or Risk Management.
At least 5 years of experience in third-party risk management, monitoring, risk assessment, IT audit, or related disciplines within regulated financial services or consulting.
Demonstrated experience with continuous monitoring platforms such as BitSight, Supply Wisdom, or equivalent, and GRC tools such as Archer or equivalent.
Solid knowledge of data analysis, contract review, data privacy, information security, information technology, and Business Continuity Planning principles.
Ability to identify, assess, and articulate risks and vulnerabilities, and sound judgment in evaluating control evidence.
Advanced Excel, AI, and analytical skills, with strong attention to detail and accuracy.
Ability to manage priorities, drive issues to closure, and meet regulatory deadlines.
Strong interpersonal, stakeholder-management, and critical-thinking skills, including ability to collaborate across the first and second lines of defense, Legal, Compliance, and senior management.
Excellent written and verbal communication skills, including ability to translate technical risks into clear business language for Third Party Managers, Business Approvers, and executive stakeholders.
In-office attendance is currently required at least 50% of the time, or five out of every ten business days.

Nice To Haves

Professional certifications are strongly preferred, such as CTPRP, CTPRA, CISA, CRISC, or CISSP.
Experience with Shared Assessments and the SIG framework is preferred.
Familiarity with U.S. regulatory expectations applicable to TPRM, including FRB SR 13-19, OCC Bulletin 2013-29, NYDFS Part 500, and FFIEC guidance, is preferred.

Responsibilities

Own end-to-end ongoing monitoring of third- and fourth-party risks across cybersecurity and enterprise risk domains, including weekly alert reviews, trend and impact analysis, ransomware and vulnerability assessments, fourth-party incident reporting, and monthly third-party and location license and data reconciliation with heat map analysis.
Evaluate composite risk ratings across macro-economic, financial, geopolitical, infrastructure, business, legal, security and compliance, scalability, and ESG domains.
Coordinate with Cyber Defense to review NCFTA alerts and identify, assess, and respond to emerging high-risk cyber threats affecting Mizuho third parties.
Serve as a primary contact for Third Party Managers, Business Approvers, Legal, Compliance, CISO/Cyber Defense, Data Loss Prevention, and subject matter experts to assess the business impact of third- and fourth-party risk events.
Document material incidents in Archer, analyze and communicate risk impacts in business terms, drive and track remediation to closure, and escalate Critical or High-risk issues to TPDD leadership and TPRM Management as appropriate.
Support monthly concentration and portfolio risk monitoring across third parties, including engagement volume, service locations, contingent workers, and sole-provider exposure; contribute to quarterly reporting and maintain accurate BitSight portfolios and Supply Wisdom license assignments.
Lead and perform due diligence reviews, reassessments, and significant change evaluations in accordance with TPRM policies and procedures.
Assess inherent risk and control effectiveness across information security, technology, business continuity, risk management, incident management, physical security, nth-party risk, and human resources; document gaps and exposures; and recommend remediation, risk acceptance, or escalation actions in Archer.
Coordinate Certificate of Insurance validation as needed and document any gaps.
Review Archer KRI reports for threshold breaches and overdue activities, assess impacts, drive remediation, escalate issues, and ensure risk acceptances are recorded and tracked.
Support internal and external audits, regulatory examinations, and Federal Banking Agency Report of Examination reviews with timely and accurate documentation; maintain audit-ready records and perform QA reviews of 10% of Moderate/Low assessments and 100% of Critical/High assessments.
Contribute to improvements to IRQs, DDQs, monitoring playbooks, KRIs, and reporting processes; identify and remediate Archer data anomalies; and support reconciliations across Archer, SNOW, Supply Wisdom, and BitSight.
Deliver monitoring activities on time and to a high standard in alignment with TPRM objectives and regulatory requirements, and perform additional responsibilities as needed to support the TPRM program.