IT Third-Party Controls Analyst

Guild Mortgage•,

7d•$82,506 - $118,345•Onsite

About The Position

The IT Third-Party Controls Analyst supports the governance, monitoring, and control of Guild's third-party relationships and external business partner access throughout the engagement lifecycle. This includes offshore staffing, SaaS/cloud providers, outsourced service providers, contractors, and non-standard access models where external users may receive elevated or internal-like access to Guild systems. Under general supervision, the role executes and monitors IT General Controls that reduce third-party and external-user risk, including due diligence support, engagement classification, access and identity oversight, provisioning and deprovisioning controls, data protection, incident response, governance reporting, and remediation tracking. The role partners with IT Governance, Information Security, IT Operations, IAM, Vendor Management, HR, Legal/Compliance, and other stakeholders to ensure access models, least-privilege controls, certifications, monitoring expectations, and onboarding/offboarding processes are appropriately defined, documented, and maintained.

Requirements

Bachelor’s degree in Business Administration, Information Technology, or a related field, or an equivalent combination of education and experience.
Minimum Five Years of Experience in IT Operations, Security, Risk, Audit, Vendor/Third-Party Risk Management, and/or offshore/outsourced staffing program administration.
Ability to work independently and collaboratively within a team environment.
Knowledge of access reviews, third-party/vendor risk management, and IT General Controls audits required.
Demonstrated ability to analyze and manipulate data across various sources including Excel, CRMs, GRC platforms, and online repositories.
Ability to interpret and explain complex IT systems, third-party relationships, and operations to varied audiences.
Advanced proficiency in Microsoft Word, Excel, and PowerPoint required.
Understanding of systems development lifecycle and change management concepts.
Understanding of financial institution governance and regulations including SSAE 16/18, FFIEC, and ISACA/COBIT.
Excellent organization and time-management skills.
Strong presentation and communication skills.
Ability to summarize large amounts of information and data for executive audiences.
Willingness to take ownership of processes, projects, and deliverables.
Customer-focused and results-oriented.
Ability to establish and meet critical deadlines.
Ability to prioritize multiple activities and complex projects simultaneously.
Strong research and problem-solving skills.
Commitment to company values.

Nice To Haves

Experience supporting or coordinating offshore/outsourced staffing, SaaS/cloud vendors, or IT contractor programs strongly preferred.
Ability to partner effectively with risk and governance functions, translating due diligence and risk assessment findings into operational controls.
Technical Project Management and/or Business Analysis experience preferred.
Ability to create, improve, and maintain IT processes. Process modeling and procedure development experience preferred.
Experience with GRC tools, vendor risk management platforms, project management tools, and IT asset-management platforms preferred.

Responsibilities

Serve as the IT General Controls contact for third-party technology relationships, including offshore staffing, SaaS/cloud providers, outsourced services, contractors, and staff augmentation.
Document third-party due diligence and approval updates and partner with IT and Compliance to keep third-party records current.
Translate completed due diligence and risk assessment findings into operational control requirements, ensuring identified risks are addressed through appropriately designed controls prior to go-live.
Own third-party engagement classification and setup, ensuring new offshore roles, contractor engagements, and outsourced arrangements are properly configured before onboarding.
Review third-party roles and access to confirm they match job function and least-privilege requirements.
Support governance and control oversight for external business partner users with elevated or internal-like access to Guild systems, including validation that access models, approved roles, identity attributes, and monitoring requirements are clearly defined and documented.
Coordinate periodic access certifications for third-party and external business partner users, confirming continued business need, appropriate branch/location segmentation, least-privilege alignment, and timely removal or adjustment of access no longer required.
Monitor virtual desktop and third-party access controls to ensure control effectiveness.
Track MFA enrollment and re-enrollment controls for third-party users, escalating gaps to IT Operations and Information Security as needed.
Oversee controls for external business partner users with elevated or internal-like access, including access models, approved roles, identity attributes, and monitoring requirements.
Coordinate access certifications for third-party and external business partner users, confirming business needs, segmentation, least privilege, and timely access removal or adjustment.
Track remediation for non-standard external access risks, including identity gaps, manual provisioning, over-provisioning, incomplete deprovisioning, and missing enhanced monitoring.
Work with IT and business stakeholders to confirm third-party access, identity, and provisioning controls remain properly scoped throughout the relationship.
Monitor IT General Controls across the third-party lifecycle to confirm vendors, offshore resources, and contractors remain within approved control parameters.
Monitor DLP controls for third-party relationships, including VDI, no-print, no-download, record retention, and data-handling requirements, with IT Governance and Information Security.
Monitor endpoint protection and CASB/Zscaler controls for third-party and offshore endpoints to confirm compliance with security policies.
Coordinate White Room setup and control validation for high-risk third-party engagements requiring enhanced physical or logical security.
Manage third-party role and scope changes, ensuring changes are documented, approved, and communicated to affected teams.
Track control issues, gaps, and remediation activities from monitoring, incidents, or audits. Maintain accurate documentation and coordinate with the IT Third-Party Risk Analyst to align remediation plans.
Plan and facilitate third-party incident tabletop exercises, documenting execution and results.
Own third-party incident escalation and reporting activities, ensuring incidents are logged, escalated, and tracked to resolution.
Prepare periodic third-party risk reporting for oversight and Governance Committees, including control performance, open issues, remediation status, evidence, metrics, and KRI support.
Support third-party Business Continuity Planning (BCP) and Disaster Recovery (DR) planning and annual testing activities.
Support internal and external audits and regulatory examinations related to third-party IT General Controls by providing control documentation, evidence, and walkthrough support.
Monitor third-party offboarding and exit controls, confirming timely removal of system and physical access and closure of contractual and data obligations when engagements end or change.
Track and support remediation of control gaps related to non-standard external access models, including inconsistent identity domains, manual provisioning processes, over-provisioned access, incomplete deprovisioning, or insufficient enhanced monitoring.
Support third-party oversight, governance activities, risk classification, location reviews, contract management, and engagement intake.
Maintain the third-party control library, including process flows, procedure documentation, and control narratives, in coordination with the broader IT team and the IT Third-Party Risk Analyst.
Produce deliverables including process flows, procedure documentation, and specialized assessment reports related to third-party processes, tools, metrics, and communication activities.
Serve as an advisor to the IT General Controls Manager on third-party control matters and act as a liaison between IT Governance, Vendor Management, Corporate Initiatives, IT Operations, Information Security, HR, Legal, Compliance, and other stakeholders.
Assist in maintaining Guild's compliance with applicable regulatory requirements as they relate to third-party staffing, sourcing, and operations.
Champion awareness and understanding of third-party control requirements through training, presentations, and regular communication.
Drive a culture of continuous improvement and customer service excellence, with visible metrics and KPIs specific to third-party control performance.
Monitor industry best practices related to third-party control frameworks and recommend enhancements to the IT General Controls Manager.
Perform other duties as assigned.