Vendor Risk Management Officer

Vendor Risk Management Officer

Banco Sabadell is seeking a Vendor Risk Management Officer candidate to join a dynamic team within one of the fastest growing banks in Florida.

Essential Duties and Responsibilities:

VRM Program Execution and Governance

Execute the day-to-day requirements, procedures, workflows, and control activities of the Vendor Risk Management program under the direction of the CISO.

Serve as the day-to-day liaison with the Head Office VRM Department for program expectations, reporting, methodology alignment, and issue escalation.

Maintain and improve the VRM calendar covering onboarding, periodic reviews, VMOR activities, risk reassessments, committee deliverables, audit requests, and reporting deadlines.

Track program obligations, follow up with accountable parties, document completion, and escalate delays or material issues.

Analyze control gaps, process efficiency, and risk trends and recommend program improvements to the CISO; management retains approval of policy changes, exceptions, and risk acceptance.

Vendor Onboarding and Due Diligence

Coordinate new-vendor onboarding through the Banks approved VRM workflow tool, currently Venminder/NContracts, or any successor platform.

Work with business owners and subject-matter experts to obtain information-security, business-continuity, privacy, compliance, financial, operational, and contractual due diligence.

Review submissions for completeness and consistency and drive follow-up with business owners, vendors, and internal reviewers.

Perform or coordinate inherent-risk assessments, risk tiering, and control reviews based on vendor criticality, data exposure, regulatory impact, service dependency, and scope.

Confirm required approvals are documented before onboarding or renewal and escalate unresolved findings, exceptions, or residual-risk decisions to the appropriate approver.

Periodic Reviews, VMOR, and Ongoing Monitoring

Coordinate the annual VMOR process with business owners, risk contributors, and control partners.

Complete periodic reviews to confirm vendor use remains consistent with the executed agreement, approved service scope, risk rating, and control expectations.

Prepare and maintain User Consideration Forms or equivalent evidence of ongoing review and oversight.

Monitor vendor alerts, risk intelligence, service changes, control issues, contract expirations, and other reassessment triggers.

Track remediation plans, findings, risk acceptances, exceptions, and overdue actions through closure; escalate aging, high-risk, or disputed items to the CISO and relevant governance forum.

Audit, Regulatory, and Evidence Management

Support internal audit, external audit, regulatory, and Head Office requests concerning VRM and third-party oversight.

Maintain complete, organized, and audit-ready evidence for onboarding, due diligence, contracts, periodic reviews, control assessments, approvals, risk decisions, and remediation.

Coordinate evidence collection with business owners, Operational Risk Management, Financial Risk Management, Information Security, Procurement, Legal, Compliance, and other stakeholders.

Identify recurring findings, documentation gaps, and process weaknesses and recommend corrective actions to the CISO.

Prepare status updates, draft management responses, and supporting materials for VRM observations, issue tracking, and closure validation, subject to management review.

DORA, Concentration Risk, and Exit Strategy Planning

Coordinate with Head Office to support DORA-aligned third-party ICT risk requirements, including identification of vendors supporting critical, important, or essential business services.

Collect, validate, and maintain vendor-dependency data used to assess concentration risk across vendors, services, business lines, legal entities, geographies, technology platforms, and subcontracting chains.

Support Operational Risk Management, Financial Risk Management, Information Security, business owners, and Head Office in evaluating reliance on single providers, connected providers, and non-substitutable ICT services.

Maintain documentation of concentration-risk assumptions, data sources, methodology, management review, risk acceptance, and escalation of high-concentration scenarios.

Coordinate annual exit-strategy tabletop exercises for essential vendors, including scenario preparation, participants, evidence, lessons learned, action tracking, and reporting.

Support updates to vendor exit and transition plans so they remain operationally credible and address business continuity, data portability, service substitution, and orderly termination.

Contracts, Reporting, and Stakeholder Coordination

Confirm vendor contracts are current, fully executed, retained in the appropriate repository, and aligned with the approved service scope and risk classification; refer legal interpretation to Legal.

Maintain complete records of contracts, due diligence, risk assessments, oversight, approvals, exceptions, and remediation evidence.

Prepare accurate VRM reports, dashboards, presentations, metrics, and executive summaries for the CISO, committees, audits, Head Office, and other governance forums.

Coordinate inputs with Operational Risk Management and Financial Risk Management and help ensure vendor risks are reflected consistently across applicable risk processes.

Facilitate communication among business owners, vendors, control partners, and management to complete assessments, approvals, remediation, and reporting on time.

Support related control activities assigned by the CISO, including the Clean Desk test and other governance, compliance, or risk-awareness activities.

Minimum Qualifications:

Bachelors degree or equivalent relevant professional experience.

35 years of experience in Vendor Risk Management, third-party risk, Risk Management, Compliance, Information Security/GRC, Operational Risk, Internal Audit, Procurement risk, or a related control function; financial-services experience is preferred.

Direct VRM or third-party due-diligence experience is preferred. Candidates from other Risk and Compliance disciplines will be considered when they demonstrate transferable experience in risk assessment, control testing, issue management, regulatory/audit support, and stakeholder coordination.

Experience coordinating multiple workstreams, maintaining audit-ready documentation, and escalating material risks or overdue actions.

Familiarity with financial-institution third-party-risk expectations, DORA, concentration risk, and vendor exit planning is preferred; equivalent relevant regulatory experience is acceptable.

Professional certification such as CTPRP, CRVPM, CISA, CRISC, CRCM, or a comparable risk/compliance credential is a plus, not required.

Ability to speak, write and read English and Spanish fluently (required)

Sabadell is an Equal Employment Opportunity Employer