Business Risk & Governance, Specialist

Vanguard•Malvern, PA

3d•Hybrid

About The Position

The Business Risk & Governance Specialist is an individual contributor supporting business risk and governance activities within the Vendor Management Office of the Investment Management Group. The initial focus of the role is third party and vendor related business risk, working closely with investment, product, and operations teams to ensure key processes are well controlled, efficient, and resilient. As business evolves, the role may gradually expand to support additional business risk and governance activities across the department. This is a hands-on role suited for someone who enjoys applying governance frameworks directly to real business processes and improving how work gets done day to day.

Requirements

5+ years of experience in business risk, operational risk, controls, investment operations, vendor management, or related disciplines
Demonstrated experience developing, enhancing, or redesigning controls
Experience operating within the business (e.g., investment operations, product, data, or front‑office‑adjacent teams), with exposure to how processes actually function
Proven ability to translate business objectives and operating models into risk requirements, controls, and governance expectations
Experience working directly with vendors or third parties as part of regular responsibilities
Bachelor’s degree or equivalent experience

Nice To Haves

Experience shaping or improving third‑party or vendor risk management frameworks
Background in investment management, market data, or financial services operations
Comfort influencing stakeholders without formal authority
Advanced degree (Master’s) in a relevant discipline

Responsibilities

Business Risk & Controls Development: Design, evaluate, and enhance risk and control frameworks by grounding them in actual business processes rather than static policy interpretation. Assess the design effectiveness of controls—not just operating effectiveness—and recommend pragmatic enhancements aligned to business realities. Identify gaps where existing policies or frameworks do not adequately address risk and propose fit‑for‑purpose solutions.
Third‑Party & Vendor Risk: Serve as the primary point of execution and design for third‑party and vendor risk activities, including onboarding, ongoing monitoring, and issue remediation. Move beyond checklist‑based compliance by shaping how third‑party risk requirements are implemented, scaled, and sustained within the business. Partner with stakeholders to embed vendor risk considerations into existing workflows rather than introducing parallel or duplicative processes.
Business Partnership & Translation: Operate as a trusted advisor within the business, working closely with front office, product, and operations teams. Provide governance and risk input early during new vendor engagements, change initiatives, and process redesigns.
Operational Governance & Execution: Execute and oversee key operational risk processes, using them as inputs to improve control design: Financial reconciliations, License management, Usage audits and reporting, Issue tracking and remediation, MiFID II support. Use findings from day‑to‑day operations to inform improvements to governance, documentation, and control structures.
Broader Scope & Initiatives: Contribute to broader business risk and governance initiatives as scope evolves. Participate in special projects requiring judgment, problem‑solving, and influence.