Head of Third Party Resilience Program Oversight

Need Help?

If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response).

Regular or Temporary: Regular

Language Fluency: English (Required)

Work Shift: 1st shift (United States of America)

The Head of Third Party Resilience is responsible for leading the strategy, governance, and execution of the firm's third party operational resilience capability. This role ensures that critical external service providers supporting the bank's core business lines and critical operations can prevent, withstand, and recover from disruptions in a manner consistent with the bank's resilience objectives, risk appetite, and regulatory expectations.

Reporting to the Head of Enterprise Resilience, this role operates as the firm's senior authority on third party resilience and partners closely with Procurement, Third Party Risk Management (TPRM), Enterprise Risk, Technology, Information Security, Legal, and Business Continuity / Disaster Recovery (BC/DR) teams to embed resilience requirements throughout the third party lifecycle.

The Head of Third Party Resilience plays a critical role in aligning outsourced services with the bank's enterprise resilience framework, Client Resilience Commitments (CRCs), and impact tolerance expectations.

Program Leadership & Governance

• 1. Lead the design, implementation, and ongoing enhancement of the Third Party Resilience Framework, policies, and standards in alignment with the Enterprise Resilience Office (ERO) and applicable regulatory guidance (e.g., FFIEC, Federal Reserve, FDIC).
• 2. Establish governance structures to oversee third party resilience risks, including escalation pathways, reporting mechanisms, and accountability models.
• 3. Deliver clear, concise reporting to executive leadership and governance committees on third party resilience posture, emerging risks, trends, and key performance and risk indicators.
• 4. Serve as the primary point of contact for regulatory examinations, internal audits, and supervisory inquiries related to third party operational resilience.

Risk Identification, Assessment & Ongoing Monitoring

• 5. [CW1.1]Assess third party dependencies that support critical business services, systems, and processes, with particular focus on vendors aligned to Client Resilience Commitments.
• 6. Maintain oversight of an authoritative inventory of critical third party services and resilience attributes, including recovery capabilities, dependencies, and concentration risks.
• 7. Direct risk based monitoring of third party resilience controls and performance, including availability, recoverability, incident management, and compliance with contractual service level expectations.
• 8. Integrate third party resilience insights into enterprise level operational resilience reporting, metrics, and risk appetite monitoring.

Contingency Planning, Testing & Recovery

• 9. Partner with business, technology, and risk stakeholders to ensure contingency, exit, and substitution strategies for critical third party services are in line with resilience expectations
• 10. Support third party participation in enterprise resilience testing, disaster recovery exercises, scenario analysis, and minimum viable bank (MVB) simulations.
• 11. Ensure third party dependencies are fully incorporated into Business Continuity, Disaster Recovery, and Enterprise Incident Management planning and execution.
• 12. Oversee review of third party testing results, after action reports, and remediation activities related to resilience gaps.

Contractual Resilience & Lifecycle Integration

• 13. Collaborate with Procurement and Legal to define and operationalize minimum resilience requirements within contracts, including incident notification expectations, recovery obligations, testing participation, and subcontractor oversight.
• 14. Partner with TPRM and TPROF to align third party resilience requirements with onboarding, periodic reassessments, and ongoing monitoring processes.
• 15. Provide subject matter expertise and effective challenge when third party arrangements do not meet enterprise resilience expectations.

Cross Functional Leadership & Influence

• 16. Influence senior business, risk, and technology leadership to embed third party resilience considerations into sourcing decisions, operating models, and service design.
• 17. Collaborate closely…