IT Third-Party Risk Manager

Abrigo•Raleigh, NC

8d•Hybrid

About The Position

We provide technology that community financial institutions use to manage risk and drive growth. Our solutions automate key processes – from anti-money laundering to fraud detection to CECL readiness to lending workflows – empowering our customers by addressing their Enterprise Risk Management needs. Abrigo is seeking an IT Third-Party Risk Manager to lead the Third-Party Risk Management Program. The role is responsible for overseeing third-party risk management operations, including audit readiness efforts, security governance processes, customer assurance support, and continuous improvement initiatives. The IT Third-Party Risk Manager serves as a key liaison between Information Security, Technology, Finance, Legal, Product, and business stakeholders to ensure IT risk management activities are executed consistently, documented appropriately, and aligned with regulatory, contractual, and organizational requirements. This position reports to the VP IT Risk & Assurance and is part of Abrigo’s CISO organization. This is a remote first role primarily based in Raleigh, NC with quarterly onsite team engagements and periodic onsite visits during external audit fieldwork.

Requirements

4+ years of IT risk assessment and/or IT audit experience to include reading and interpreting the results of audit reports (SOC 1, SOC 2, etc.), security assessments (penetration tests, vulnerability scans, etc.), and continuity exercises (disaster recovery, security incident, etc.)
Bachelor's degree in Information Systems, Risk Management, Business Administration, Accounting, or a related field.
Working knowledge of information security standards and laws (e.g., NIST, FFIEC, GLBA, etc.), and commonly used concepts, practices and procedures within the information security and privacy field.
Experience supporting IT risk management, information security, internal audit, compliance, or third-party risk management programs.
Excellent communication skills and be able to write, speak and present to all levels of management.
Strong organizational ethic to manage a large volume of competing tasks effectively.

Nice To Haves

Professional certification, such as CRVPM, TPCRA, CISA, or CRISC, are preferred.

Responsibilities

Lead operational administration of Abrigo's Third-Party Risk Management Program.
Coordinate vendor onboarding, inherent and residual risk reviews, due diligence collection, and annual reassessments.
Review vendor security documentation including SOC reports, security questionnaires, policies, certifications, and risk assessments and determine appropriate actions required based upon the review.
Maintain vendor records, ownership assignments, and supporting documentation within approved governance platforms.
Monitor vendor review schedules, risk treatment activities, contract obligations, and remediation commitments.
Assist in developing metrics, dashboards, and reporting related to risk, compliance, vendor governance, and audit activities.
Research new and developing technologies and standards to help contribute to the continuous improvement of the risk assessment process.
Act as a subject matter expert in understanding why certain risks are a threat to the company and how compensating or mitigating processes affect that risk.
Maintain and enhance policies, training materials, and operational playbooks.
Promote continuous improvement through automation, process optimization, and effective use of technology.
Assist with maintenance of customer assurance materials, trust documentation, and standardized security responses, with a focus on third-party activities.
Support audit cycles through collection of evidence requests, testing coordination, issue management, and audit response activities.
Other duties as assigned.
Occasional travel required for team events to support engagement, relationship-building, and key decision-making.