IT Third-Party Risk Assessor

Do you want your voice heard and your actions to count? Discover your opportunity with Mitsubishi UFJ Financial Group (MUFG), one of the world’s leading financial groups. Across the globe, we’re 150,000 colleagues, striving to make a difference for every client, organization, and community we serve. We stand for our values, building long-term relationships, serving society, and fostering shared and sustainable growth for a better world.With a vision to be the world’s most trusted financial group, it’s part of our culture to put people first, listen to new and diverse ideas and collaborate toward greater innovation, speed and agility. This means investing in talent, technologies, and tools that empower you to own your career.Join MUFG, where being inspired is expected and making a meaningful impact is rewarded.The selected colleague will work at an MUFG office or client sites four days per week and work remotely one day. A member of our recruitment team will provide more details.The IT Third-Party Risk Assessor is responsible for evaluating, monitoring, and reporting on information technology risks associated with third-party vendors, suppliers, service providers, and other external business partners. This role supports the organization's Third-Party Risk Management (TPRM) program by conducting risk assessments, reviewing cybersecurity controls, identifying potential vulnerabilities, and ensuring third parties comply with organizational policies, industry standards, and regulatory requirements.The successful candidate will evaluate the information security and technology frameworks of external partners, SaaS providers, and financial technology associates. This position enforces strict alignment with banking regulations, manages risk lifecycles inside Archer, and leverages AI technologies to accelerate due diligence and continuous monitoring. TPRM SME will partner with business stakeholders, procurement / contract management teams, security teams, compliance functions, and vendors to identify and mitigate risks throughout the third-party lifecycle.Key ResponsibilitiesThird-Party Risk AssessmentsConduct cybersecurity, information security, and technology risk assessments of third-party vendors and service providers.Review vendor security documentation, including:SIG questionnairesSOC 1 and SOC 2 reports (may include Bridge Letter verification)ISO 27001 certifications to include SoA reviewsArcher Management: Track, document, and manage the end-to-end vendor risk lifecycle within Archer GRC.AI Tool Integration: Use AI-powered risk platforms to parse vendor documentation and summarize control gaps.Security policies and proceduresAssess inherent and residual risks associated with third-party relationships.Evaluate vendor compliance with internal policies, security standards, and regulatory requirements.Risk Analysis and ReportingIdentify and document control gaps, vulnerabilities, and areas of concern.Develop risk ratings and provide recommendations for risk mitigation.Prepare concise risk assessment reports and executive-level summaries.Present assessment findings to business owners, risk committees, and senior management.Ongoing MonitoringPerform periodic reassessments of critical and high-risk vendors.Monitor vendors for cybersecurity incidents, financial instability, regulatory actions, and emerging risks.Track remediation activities and validate corrective actions.Maintain vendor risk profiles and assessment documentation.Stakeholder CollaborationPartner with Procurement, Information Security, Legal, Compliance, Privacy, and Business Units throughout the vendor lifecycle.Provide guidance regarding security requirements during vendor onboarding and renewals.Support contract reviews by recommending security and data protection requirements.Assist business partners in understanding and managing third-party technology risks.Governance, Risk, and ComplianceEnsure alignment with regulatory requirements and industry frameworks such as:NIST Cybersecurity FrameworkNIST CRINIST 800-53NIST 800-171FFIEC GuidanceISO 27001HIPAA (as applicable)Support audits, examinations, and regulatory reviews related to third-party risk.Contribute to continuous improvements of the Third-Party Risk Management Program.Required QualificationsEducationBachelor's degree in Information Technology, Information Security, Cybersecurity, Risk Management, Business Administration, or a related field.Equivalent combination of education and experience will be considered.Experience5+ years of experience in:Third-Party Risk Management (TPRM)Information SecurityCybersecurity Risk ManagementIT AuditTechnology RiskOperational RiskBusiness Continuity PlanningExperience reviewing vendor security assessments and industry-standard assurance reports.Experience working in regulated industries such as financial services, healthcare, insurance, or technology preferred.Banking Knowledge: Solid understanding of financial regulatory expectations regarding data protection and operational resilience.Technical KnowledgeUnderstanding of cybersecurity principles and security control frameworks.Familiarity with:Access managementNetwork securityCloud securityData protection and encryptionDisaster recovery and business continuityVulnerability managementIncident responseService Level Management (Agreements review & verification)Release Management / SDLCIT Asset ManagementIT Configuration ManagementChange ManagementProblem ManagementSystem Capacity and PerformanceKnowledge of vendor risk assessment methodologies and control evaluation techniques.Preferred CertificationsOne or more of the following certifications are preferred:Certified Information Systems Security Professional (CISSP)Certified Information Security Manager (CISM)Certified Third-Party Risk Professional (CTPRP)Certified Third Party Risk Assessor (CTPRA)Certified Information Systems Auditor (CISA)Certified in Risk and Information Systems Control (CRISC)Certified Cloud Security Professional (CCSP)Security+ or equivalent cybersecurity certificationKey CompetenciesRisk assessment and analysisCritical thinking and problem solvingTPRM Full LifecycleInformation security knowledgeRegulatory and compliance awarenessWritten and verbal communicationExecutive reporting and presentation skillsAttention to detailStakeholder relationship managementTime management and organizationSuccess MetricsTimely completion of third-party risk assessments.Quality and accuracy of risk evaluations.Reduction of unresolved vendor control issues.Effectiveness of remediation tracking and closure.Compliance with regulatory and internal TPRM requirements.Positive audit and examination outcomes.Continuous improvement of third-party risk processes and controls.Reporting StructureReports To: Head of Data and Financial Operations TransformationIndividual Contributor: YesTravel: Minimal (0-10%)Comp Range: 125k-164kWork Arrangement: Hybrid (based on business needs)This position plays a critical role in protecting the organization from cybersecurity, operational, compliance, and reputational risks arising from third-party relationships while enabling the business to engage vendors safely and effectively.We will consider for employment all qualified applicants, including those with criminal histories, in a manner consistent with the requirements of applicable state and local laws (including (i) the San Francisco Fair Chance Ordinance, (ii) the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, (iii) the Los Angeles County Fair Chance Ordinance, and (iv) the California Fair Chance Act) to the extent that (a) an applicant is not subject to a statutory disqualification pursuant to Section 3(a)(39) of the Securities and Exchange Act of 1934 or Section 8a(2) or 8a(3) of the Commodity Exchange Act, and (b) they do not conflict with the background screening requirements of the Financial Industry Regulatory Authority (FINRA) and the National Futures Association (NFA). The major responsibilities listed above are the material job duties of this role for which the Company reasonably believes that criminal history may have a direct, adverse and negative relationship potentially resulting in the withdrawal of conditional offer of employment, if any.The above statements are intended to describe the general nature and level of work being performed. They are not intended to be construed as an exhaustive list of all responsibilities duties and skills required of personnel so classified.We are proud to be an Equal Opportunity Employer and committed to leveraging the diverse backgrounds, perspectives and experience of our workforce to create opportunities for our colleagues and our business. We do not discriminate on the basis of race, color, national origin, religion, gender expression, gender identity, sex, age, ancestry, marital status, protected veteran and military status, disability, medical condition, sexual orientation, genetic information, or any other status of an individual or that individual’s associates or relatives that is protected under applicable federal, state, or local law.SummaryLocation: Tempe, AZ; Tampa, FLType: Full time