Mgr, Third-Party Rick Management

We want to invest in YOU! At BCU, we believe our success starts with our people, and we're committed to creating an environment where you can thrive through career growth opportunities, competitive benefits, workplace flexibility, and a collaborative culture.

BCU is a not-for-profit, member-owned Credit Union with nearly $6 billion in assets and more than 370,000 members . We provide easy, secure banking solutions that help people achieve financial freedom while serving employees and families of major Fortune 100 organizations and communities across northern Illinois, southern Wisconsin, Minnesota, and Puerto Rico.

We're proud to be Certified™ by Great Place to Work® from March 2026 through March 2027 , reflecting our commitment to an inclusive culture where employees feel valued, supported, and empowered. Click HERE to read more.

Looking for a great place to work? Let's talk. Click HERE to view our benefits website.

SALARY This position has a base salary range of $120,000.00 - $180,000.00 USD Annual . This range represents the expected base salary range for this position. The actual salary may vary based upon several factors including, but not limited to, relevant skills/experience and time in the role.

Summary This role is responsible for overseeing and enhancing BCU's Third-Party Risk Management (TPRM) Program. This role leads the assessment, monitoring, governance, and reporting of risks associated with vendors and other third-party relationships, ensuring compliance with regulatory expectations and alignment with BCU's enterprise risk appetite.

The position owns the end-to-end third-party risk process, including onboarding, risk tiering, due diligence, contract review, ongoing monitoring, issue management, and offboarding. This role is also responsible for program governance, reporting, regulatory readiness, and continuous improvement initiatives designed to strengthen BCU's third-party risk framework.

Role And Responsibilities

• Manage BCU's Third-Party Risk Management Program, including policies, standards, procedures, and governance frameworks ensuring alignment with applicable regulatory requirements, including NCUA, FFIEC, CFPB, GLBA, NIST, and other relevant industry guidance.
• Maintain and make recommendations to enhance risk-based methodologies for vendor segmentation, inherent risk assessments, due diligence, ongoing monitoring, and issue management.
• Prepare and deliver risk reporting, metrics, and dashboards to executive leadership, management committees, and audit stakeholders.
• Support regulatory examinations, internal audits, and external reviews related to third-party risk management activities.
• With the assistance of advisors in Finance, Business Resiliency, Information Technology, Information Security, Procurement and Legal, evaluating vendor controls, practices, and supporting documentation, including SOC reports, cybersecurity assessments, business continuity plans, financial statements, insurance coverage, and compliance evidence.
• Identify control gaps and risk exposures, document findings, and partner with business owners to create mitigation strategies.
• Manage ongoing monitoring activities for critical and high-risk third parties.
• Maintain accurate third-party inventories, risk ratings, documentation, and assessment records.
• Perform basis system administration and optimization of the vendor management platform, including workflow configuration, reporting, user support, and data quality oversight.
• Identify opportunities to automate processes, improve efficiency, and enhance program maturity.
• Maintain procedures, templates, assessment tools, and training materials supporting the TPRM program.

Qualifications And Education Requirements

• Bachelor’s degree in Business, Finance, Risk Management, Information Systems, Cybersecurity, Accounting, or a related field.
• 5 years of experience in Third-Party Risk Management, Vendor Management, Enterprise Risk Management, Information Security, or a related discipline.
• Strong understanding of third-party risk lifecycle management, including onboarding, due diligence, risk assessments, ongoing monitoring, issue management, contract review, and offboarding.
• Experience evaluating vendor documentation, including SOC 1 and SOC 2 reports, cybersecurity assessments, business continuity plans, financial statements, and compliance certifications.
• Working knowledge of regulatory expectations governing financial institutions and third-party relationships.
• Experience using Governance, Risk, and Compliance (GRC) platforms and vendor management systems.
• Strong analytical, organizational, project management, and communication skills.
• Ability to influence stakeholders and effectively communicate risk to both technical and non-technical audiences.

Our WHY is the reason we exist: To Empower People to Discover Financial Freedom. What do you celebrate as your purpose? At BCU we celebrate what makes you authentically YOU! #bYOU

Click HERE to watch a short video to learn more about life at BCU!

BCU Shared Values

• We foster an environment of INCLUSION. All individuals are treated fairly and respectfully, have equal access to opportunities and resources, and can contribute fully to the organization's success.
• We act with INTEGRITY. We follow the golden rule without exception.
• We display COURAGE in our convictions. We drive innovation, reaching beyond boundaries and thoughtfully explore new horizons.
• We excel through COLLABORATION. By working as one, sharing information and seeking solutions, we deliver exceptional outcomes.
• We WOW our members. We focus intensely on putting the member first, delivering extraordinary experiences that create lasting relationships inside and outside the organization.