Vendor Risk Management Officer

Banco Sabadell•Miami Lakes, FL

About The Position

Banco Sabadell is seeking a Vendor Risk Management Officer to join a dynamic team. The role executes and governs the day-to-day Vendor Risk Management (VRM) program under the direction of the CISO and serves as a liaison with the Head Office VRM Department. The officer coordinates vendor onboarding, due diligence, periodic reviews, ongoing monitoring, audit and regulatory support, concentration-risk assessment, exit-strategy planning, contract records, reporting, and stakeholder coordination. The position also supports related control activities assigned by the CISO. Management retains approval of policy changes, exceptions, and risk acceptance.

Requirements

Bachelor’s degree or equivalent relevant professional experience.
3–5 years of experience in Vendor Risk Management, third-party risk, Risk Management, Compliance, Information Security/GRC, Operational Risk, Internal Audit, Procurement risk, or a related control function.
Experience coordinating multiple workstreams, maintaining audit-ready documentation, and escalating material risks or overdue actions.
Ability to speak, write, and read English and Spanish fluently.

Nice To Haves

Financial-services experience is preferred.
Direct VRM or third-party due-diligence experience is preferred; candidates from other Risk and Compliance disciplines may be considered with transferable experience in risk assessment, control testing, issue management, regulatory/audit support, and stakeholder coordination.
Familiarity with financial-institution third-party-risk expectations, DORA, concentration risk, and vendor exit planning is preferred; equivalent relevant regulatory experience is acceptable.
Professional certification such as CTPRP, CRVPM, CISA, CRISC, CRCM, or a comparable risk/compliance credential is a plus, but not required.

Responsibilities

Execute the day-to-day requirements, procedures, workflows, and control activities of the VRM program under the direction of the CISO.
Serve as the day-to-day liaison with the Head Office VRM Department on program expectations, reporting, methodology alignment, and issue escalation.
Maintain and improve the VRM calendar, track program obligations, document completion, and escalate delays or material issues.
Analyze control gaps, process efficiency, and risk trends and recommend program improvements to the CISO.
Coordinate vendor onboarding through the approved VRM workflow tool and work with business owners and subject-matter experts to collect due diligence information.
Review vendor submissions for completeness and consistency; coordinate follow-up among business owners, vendors, and internal reviewers.
Perform or coordinate inherent-risk assessments, risk tiering, and control reviews; confirm required approvals and escalate unresolved findings, exceptions, or residual-risk decisions.
Coordinate the annual VMOR process and perform periodic reviews of vendor use, agreements, service scope, risk ratings, and control expectations.
Prepare and maintain User Consideration Forms or equivalent ongoing-review evidence; monitor vendor alerts, risk intelligence, service changes, control issues, contract expirations, and reassessment triggers.
Track remediation plans, findings, risk acceptances, exceptions, and overdue actions through closure, escalating aging, high-risk, or disputed items.
Support internal and external audits, regulatory requests, and Head Office requests concerning VRM and third-party oversight; maintain complete, organized, audit-ready evidence.
Coordinate evidence collection with business owners and risk, security, procurement, legal, compliance, and other stakeholders; identify documentation gaps and recommend corrective actions.
Prepare status updates, draft management responses, and supporting materials for VRM observations, issue tracking, and closure validation, subject to management review.
Coordinate with Head Office to support DORA-aligned third-party ICT risk requirements and identify vendors supporting critical, important, or essential business services.
Collect, validate, and maintain vendor-dependency data for concentration-risk assessment; support evaluation of reliance on single, connected, or non-substitutable ICT providers.
Maintain documentation of concentration-risk assumptions, data sources, methodology, management review, risk acceptance, and escalation of high-concentration scenarios.
Coordinate annual exit-strategy tabletop exercises for essential vendors and support updates to vendor exit and transition plans.
Confirm vendor contracts are current, fully executed, retained appropriately, and aligned with approved service scope and risk classification; refer legal interpretation to Legal.
Prepare VRM reports, dashboards, presentations, metrics, and executive summaries for the CISO, committees, audits, Head Office, and other governance forums.
Coordinate risk-process inputs with Operational Risk Management and Financial Risk Management and facilitate communication among business owners, vendors, control partners, and management.
Support related control activities assigned by the CISO, including the Clean Desk test and other governance, compliance, or risk-awareness activities.