Third Party Risk Manager

Mercury•San Francisco, NY

About The Position

Mercury is developing its Third Party Risk Management (TPRM) program to meet bank-level regulatory expectations as it prepares to become a bank. As an early member of the growing TPRM team, the Third Party Risk Manager helps run the program day to day and contributes to its development. The role protects Mercury, its customers, and the broader financial ecosystem from risks associated with third parties. Reporting to the Senior Manager, Third Party Risk Management, this position conducts third-party risk assessments, supports risk reporting, and performs second-line oversight. It focuses on enterprise-wide TPRM rather than deep expertise in a single domain. The manager works with subject-matter experts in Compliance, Information Security, Privacy, and Procurement to reflect their requirements in the program and address the third-party lifecycle and regulatory expectations associated with banking.

Requirements

At least 4 years of third-party risk management experience, including at least 2 years in a regulated financial services environment such as a bank or fintech working with bank partners.
Working knowledge of regulatory guidance on third-party risk, including the Interagency Guidance on Third Party Relationships and related FFIEC, OCC, and FDIC expectations, as well as industry practices across the third-party lifecycle: planning, due diligence, contracting, monitoring, and termination.
Hands-on experience completing third-party risk assessments across multiple risk domains, not only security.
Experience reviewing and challenging first-line risk work with evidence-based pushback.
Experience supporting audits or examinations of a TPRM program, including gathering evidence, responding to requests, and following up on findings.
Experience building or maintaining TPRM reporting and metrics, with attention to data accuracy.
Solid program and project management skills, including experience supporting a program with multiple cross-functional components and driving process improvements through implementation.
Proven ability to influence cross-functional partners, including Procurement, Finance, Information Security, Legal, and Privacy, without direct authority.
Clear communication skills, including the ability to explain a risk position and maintain it under pushback.

Nice To Haves

Experience at a bank or a fintech moving toward banking.
Experience improving or uplifting an existing TPRM program.
Experience with TPRM tooling, automation, or AI-enabled workflows.
Familiarity with enterprise risk concepts such as risk registers, risk appetite, and committee reporting.
Relevant certification, such as CISA or CGRC.

Responsibilities

Complete third-party risk assessments, risk-rate third parties, and open and track issues through resolution.
Review and challenge first-line due diligence and ongoing monitoring, including related reporting, approvals, and oversight activities.
Support maintenance of third-party risk reporting and metrics for management and governance forums, and help ensure underlying data is accurate.
Help implement tooling and automation to improve process efficiency.
Support and contribute to TPRM program improvements, including updates to policies, due diligence, risk assessment processes, and risk management across the third-party lifecycle.
Work with subject-matter experts across Compliance, Information Security, Privacy, and Procurement to incorporate their requirements into the program.
Support audits or examinations of the TPRM program by gathering evidence, responding to requests, and following up on findings.