Third Party Risk Manager

Mercury•Portland, OR

1d•$119,200 - $165,500

About The Position

Mercury is developing its Third Party Risk Management (TPRM) program to meet bank-level regulatory expectations as it prepares to become a bank. This role is an early member of a growing TPRM team and helps operate and mature the program. The Third Party Risk Manager protects Mercury, its customers, and the broader financial ecosystem from risks associated with third parties by completing risk assessments, supporting risk reporting, and conducting second-line oversight. The position focuses on enterprise-wide TPRM rather than deep expertise in a specific domain. The manager works with subject-matter experts across Compliance, Information Security, Privacy, and Procurement to incorporate their requirements and address the full third-party lifecycle and regulatory expectations associated with banking. The role reports to the Senior Manager, Third Party Risk Management.

Requirements

At least 4 years of third-party risk management experience, including at least 2 years in a regulated financial services environment, such as a bank or fintech working with bank partners.
Working knowledge of regulatory guidance on third-party risk, including the Interagency Guidance on Third Party Relationships and related FFIEC, OCC, and FDIC expectations, as well as TPRM practices across planning, due diligence, contracting, monitoring, and termination.
Hands-on experience completing third-party risk assessments across multiple risk domains, not only security.
Experience reviewing and challenging first-line risk work with evidence-based pushback.
Experience supporting TPRM program audits or examinations, including gathering evidence, responding to requests, and following up on findings.
Experience building or maintaining TPRM reporting and metrics, with attention to data accuracy.
Solid program and project management skills, including supporting cross-functional programs and driving process improvements through implementation.
Ability to influence cross-functional partners, including Procurement, Finance, Information Security, Legal, and Privacy, without direct authority.
Clear communication skills, including the ability to explain a risk position and maintain it under pushback.

Nice To Haves

Experience at a bank or a fintech moving toward banking.
Experience improving or uplifting an existing TPRM program.
Experience with TPRM tooling, automation, or AI-enabled workflows.
Familiarity with enterprise risk concepts such as risk registers, risk appetite, and committee reporting.
Relevant certification, such as CISA or CGRC.

Responsibilities

Complete third-party risk assessments, risk-rate third parties, and open and track issues through resolution.
Provide second-line oversight by reviewing and challenging first-line due diligence and ongoing monitoring, including related reporting, approvals, and oversight activities.
Support maintenance of third-party risk reporting and metrics for management and governance forums, and help ensure the underlying data is accurate.
Help implement tooling and automation to improve process efficiency.
Contribute to TPRM program uplift, including updates to policies, due diligence, risk assessment processes, and risk management across the third-party lifecycle.