Senior Manager, Third Party Risk Management

StoneX Group • Chicago, IL

9d • Hybrid

About The Position

StoneX Group Inc. is seeking an experienced Senior Manager, Third Party Risk Management (TPRM), to lead the global program across all legal entities. Based in the Chicago office and reporting to the Global Head of Enterprise Risk, this senior Second Line of Defense role is responsible for the design, oversight, and continuous improvement of the TPRM framework across the Firm’s regulated activities.

The role provides strategic and operational leadership across the full third-party lifecycle. It ensures that risks related to third parties, suppliers, outsourcing arrangements, and other external relationships are identified, assessed, managed, monitored, and reported in line with the organization’s risk appetite, policies, regulatory obligations, and business objectives. The Senior Manager serves as a TPRM subject matter expert and partners with Business Owners, Procurement, Legal, Compliance, Information Security, Privacy, Business Resilience, Finance, and other risk and control functions.

The position is expected to advance the program beyond transactional risk assessments by establishing strong governance, useful risk reporting, effective challenge, ongoing monitoring, technology-enabled processes, and a defined maturity roadmap. The working style is four days per week onsite and one day per week remote. The hiring salary range is $155,000–$170,000. Subject to business performance and management recommendations, the role may be eligible for incentive compensation. A range of medical, financial, and other benefits is offered, depending on the position.

Requirements

• 5–8 years of experience in Third Party Risk Management, Operational Risk, Supplier Risk, Procurement Risk, or a related discipline.
• Demonstrated experience designing, implementing, enhancing, or managing an enterprise TPRM framework.
• Strong understanding of the end-to-end third-party lifecycle and associated governance, risk, and control requirements.
• Experience developing risk methodologies, policies, standards, procedures, governance, and management reporting.
• Experience managing complex risk remediation or program transformation initiatives.
• Strong knowledge of third-party risk assessment, ongoing monitoring, criticality methodology, issue management, and risk acceptance.
• Experience interacting with senior management, internal audit, compliance, regulators, or independent assurance functions.
• Demonstrated ability to lead cross-functional initiatives and influence stakeholders outside direct reporting lines.
• Strong written and verbal communication skills, including the ability to translate complex risk matters into concise executive-level reporting.
• Bachelor’s degree in Risk Management, Business, Accounting, Finance, or a related discipline, or equivalent professional experience.

Nice To Haves

• Experience within financial services or another highly regulated environment.
• Experience supporting global or multi-jurisdictional TPRM programs.
• Knowledge of outsourcing, operational resilience, ICT risk, cybersecurity, privacy, and concentration-risk requirements.
• Experience implementing or enhancing TPRM/GRC technology platforms and workflow automation.
• Experience developing TPRM dashboards, KRIs, KPIs, risk-appetite metrics, and Board or executive reporting.
• Relevant professional certifications such as CRISC, CISA, CISM, CISSP, CTPRP, CBCP, or equivalent risk, security, audit, or third-party risk credentials.

Responsibilities

• Own and drive the ongoing design, implementation, enhancement, and maturity of the enterprise TPRM program.
• Develop and maintain a multi-year TPRM strategy and maturity roadmap aligned with organizational priorities, risk appetite, regulatory expectations, and industry practices.
• Assess the program against regulatory requirements, internal standards, industry frameworks, audit findings, risk events, and improvement opportunities.
• Identify opportunities to simplify, standardize, automate, and strengthen TPRM processes while maintaining appropriate risk coverage.
• Establish program maturity metrics and demonstrate measurable improvement in capabilities and outcomes.
• Lead strategic initiatives addressing regulatory findings, audit observations, control deficiencies, and broader program enhancements.
• Oversee risk management across the third-party lifecycle, from business need and initial engagement through due diligence, assessment, approval, contracting, onboarding, monitoring, reassessment, issue remediation, change management, renewal, offboarding, and termination.
• Ensure lifecycle requirements are risk-based and proportionate, with enhanced requirements for critical, material, high-risk, outsourced, or otherwise significant relationships.
• Maintain the enterprise TPRM framework, policy, standards, procedures, methodologies, and supporting documentation.
• Establish roles, responsibilities, decision rights, escalation requirements, and accountability across the TPRM operating model.
• Embed TPRM requirements in procurement, contracting, sourcing, operational risk, and business processes.
• Chair or support TPRM governance forums and provide risk information to management and risk committees.
• Establish escalation mechanisms for material third-party risks, overdue assessments, remediation activities, policy exceptions, concentration risks, and emerging concerns.
• Promote consistent application of TPRM requirements across business units, legal entities, and geographic regions.
• Oversee third-party risk assessment methodologies across applicable risk domains, including information and cybersecurity, privacy, resilience, financial viability, regulatory and compliance, legal and contractual, concentration and dependency, subcontractor, geographic, reputational, technology, and cloud risks.
• Provide effective challenge where third-party risks are not appropriately identified, assessed, accepted, mitigated, or monitored.
• Ensure material residual risks and exceptions are escalated to the appropriate risk acceptance authority.
• Maintain oversight of third-party issues and remediation plans through closure.
• Maintain methodologies for identifying critical, material, and high-risk third parties and outsourcing arrangements; oversee enhanced due diligence and monitoring for higher-risk relationships.
• Develop and enhance approaches for identifying and monitoring third-party concentration, geographic, technology, service-provider, and systemic dependencies.
• Partner with Operational Resilience and Business Continuity teams to evaluate third parties supporting critical or important business services.
• Ensure exit strategies, contingency arrangements, and resilience considerations are incorporated into management of critical third parties.
• Develop and oversee comprehensive ongoing monitoring, including internal and external risk indicators, assessment results, incidents, financial condition, cybersecurity developments, service performance, and regulatory developments.
• Define triggers for reassessment, escalation, remediation, and enhanced monitoring, and establish mechanisms to identify and evaluate emerging portfolio risks.
• Own development and delivery of TPRM management information, KRIs, KPIs, dashboards, and executive reporting.
• Report on third-party populations and risk profiles, critical and high-risk third parties, assessment status, overdue reviews, findings and remediation, exceptions and risk acceptances, concentration risks, incidents, regulatory and audit commitments, and program performance and maturity.
• Provide concise, decision-useful reporting to executive management, risk committees, and other governance forums; use trend analysis and portfolio insights to identify elevated or emerging risks.
• Provide business ownership and strategic direction for TPRM technology, workflow, and data capabilities.
• Drive automation and process optimization to improve efficiency, scalability, data quality, and user experience.
• Define data standards and controls for a complete, accurate, and reliable third-party inventory; partner with Technology and other stakeholders on platform and integration enhancements.
• Maintain awareness of evolving third-party, outsourcing, resilience, technology, cybersecurity, and supplier-risk requirements across applicable jurisdictions.
• Coordinate TPRM responses to regulatory inquiries, examinations, internal audits, independent reviews, and compliance assessments.
• Oversee remediation of regulatory, audit, and assurance findings and provide evidence of sustainable closure.
• Maintain program documentation and evidence demonstrating the design and operating effectiveness of the TPRM framework; partner with independent assurance functions on continuous improvement.
• Act as a trusted TPRM advisor to senior management, business leaders, procurement teams, and risk and control functions.
• Establish clear accountability for third-party risk ownership within the business and build relationships across relevant business and control functions.
• Provide guidance on complex or elevated third-party engagements and facilitate risk-based decision-making.
• Develop training, guidance, and communications to strengthen third-party risk awareness and accountability.
• Lead, coach, and develop TPRM professionals; establish objectives, responsibilities, performance expectations, and development opportunities.
• Ensure adequate team capability and capacity and promote ownership, effective challenge, collaboration, continuous improvement, and sound risk judgment.

Benefits

• Medical benefits
• Financial benefits
• Other benefits, dependent on position
• Potential eligibility for incentive compensation, subject to business performance and management recommendations

What This Job Offers

• Job Type: Full-time
• Career Level: Senior