Senior Third Party Enterprise Risk Management Analyst

Members 1st Federal Credit Union•Enola, PA

About The Position

The Senior Third Party Enterprise Risk Management Analyst protects Members 1st from risks associated with vendors, suppliers, contractors, and other external partners. The role evaluates third-party relationships throughout their lifecycle, including onboarding, ongoing monitoring, and offboarding, to support compliance with internal policies, regulatory requirements, and industry best practices. The analyst conducts complex vendor risk assessments, reviews due diligence documentation, identifies control gaps, and recommends remediation. The role also supports vendor onboarding and criticality assessments, tracks vendor performance and remediation activities, maintains audit documentation, and prepares reports for leadership, risk committees, and auditors. The analyst collaborates with Legal, Procurement, IT Security, Compliance, and business units, escalates high-risk findings, and provides guidance, training, and mentorship to internal teams and associates. The position requires 5–8 years of related experience and general and business knowledge equivalent to a bachelor’s degree. Preferred certifications include CTPRP, CTPRA, and CRISC. The minimum salary is $70,000 per year, with the possibility of a higher salary based on factors such as experience, skills, education, and location.

Requirements

5–8 years of related experience.
General and business knowledge equivalent to a bachelor’s degree.
Advanced analytical, problem-solving, and critical-thinking skills.
Strong interpersonal, communication, and collaboration skills.
Knowledge of credit union products, services, and processes.
Strong research skills.
Strong working knowledge of third-party risk management theory, tools, and practices.
Ability to communicate effectively in English, orally and in writing.
Ability to perform visual tasks such as preparing and analyzing data and figures, viewing a computer terminal, and extensive reading.
Ability to sit for extended periods.
Sufficient manual skill to operate a PC keyboard and standard office equipment.
Ability to travel, including occasional overnight travel.
Ability to exert minimum amounts of force occasionally to lift, carry, push, pull, or move objects.

Nice To Haves

CTPRP certification.
CTPRA certification.
CRISC certification.

Responsibilities

Conduct comprehensive risk assessments for complex new and existing third-party vendors, including financial, operational, IT security, and compliance risks.
Obtain and review vendor documentation, including SOC reports, penetration test results, business continuity plans, and security questionnaires.
Identify and document control gaps and recommend remediation actions.
Support vendor onboarding by evaluating vendor criticality and determining required due diligence levels.
Monitor vendors through periodic reviews, risk-scoring updates, and performance tracking.
Ensure third-party risk processes align with applicable regulatory frameworks and standards, including NIST, SOC 2, GDPR, and FFIEC.
Maintain documentation and audit trails for internal and external audits.
Track and manage vendor remediation plans, exceptions, and risk mitigation activities.
Prepare dashboards and reports for leadership, risk committees, and auditors.
Escalate high-risk findings and collaborate with stakeholders to resolve issues.
Partner with Legal, Procurement, IT Security, Compliance, and business units to ensure consistent vendor oversight.
Provide guidance and training to internal teams on third-party risk policies and best practices.
Provide guidance, mentorship, and hands-on training to associates to strengthen team capabilities and ensure consistent application of third-party risk processes.