IT Third-Party Controls Analyst

Guild Mortgage Company , closing loans and opening doors since 1960. As a mortgage banking firm we are dedicated to serving the home owner/buyer. Our goal is to provide affordable home financing for our customers, utilizing the best terms available while providing a level of professionalism and service unsurpassed in the lending industry.

The IT Third-Party Controls Analyst supports the governance, monitoring, and control of Guild's third-party relationships and external business partner access throughout the engagement lifecycle. This includes offshore staffing, SaaS/cloud providers, outsourced service providers, contractors, and non-standard access models where external users may receive elevated or internal-like access to Guild systems.

Under general supervision, the role executes and monitors IT General Controls that reduce third-party and external-user risk, including due diligence support, engagement classification, access and identity oversight, provisioning and deprovisioning controls, data protection, incident response, governance reporting, and remediation tracking. The role partners with IT Governance, Information Security, IT Operations, IAM, Vendor Management, HR, Legal/Compliance, and other stakeholders to ensure access models, least-privilege controls, certifications, monitoring expectations, and onboarding/offboarding processes are appropriately defined, documented, and maintained.

This role is an exempt position with a Targeted Salary Range of $82,506 to $ annually.

Compensation at Guild is influenced by a wide array of factors including but not limited to local and federal minimum wage requirements, education, level of experience, and applicant’s geographical location.

Serve as the IT General Controls contact for third-party technology relationships, including offshore staffing, SaaS/cloud providers, outsourced services, contractors, and staff augmentation.

• Document third-party due diligence and approval updates and partner with IT and Compliance to keep third-party records current.
• Translate completed due diligence and risk assessment findings into operational control requirements, ensuring identified risks are addressed through appropriately designed controls prior to go-live.
• Own third-party engagement classification and setup, ensuring new offshore roles, contractor engagements, and outsourced arrangements are properly configured before onboarding.
• Review third-party roles and access to confirm they match job function and least-privilege requirements.
• Support governance and control oversight for external business partner users with elevated or internal-like access to Guild systems, including validation that access models, approved roles, identity attributes, and monitoring requirements are clearly defined and documented.
• Coordinate periodic access certifications for third-party and external business partner users, confirming continued business need, appropriate branch/location segmentation, least-privilege alignment, and timely removal or adjustment of access no longer required.
• Monitor virtual desktop and third-party access controls to ensure control effectiveness.
• Track MFA enrollment and re-enrollment controls for third-party users, escalating gaps to IT Operations and Information Security as needed.
• Oversee controls for external business partner users with elevated or internal-like access, including access models, approved roles, identity attributes, and monitoring requirements.
• Coordinate access certifications for third-party and external business partner users, confirming business needs, segmentation, least privilege, and timely access removal or adjustment.
• Track remediation for non-standard external access risks, including identity gaps, manual provisioning, over-provisioning, incomplete deprovisioning, and missing enhanced monitoring.
• Work with IT and business stakeholders to confirm third-party access, identity, and provisioning controls remain properly scoped throughout the relationship.
• Monitor IT General Controls across the third-party lifecycle to confirm vendors, offshore resources, and contractors remain within approved control parameters.
• Monitor DLP controls for third-party relationships, including VDI, no-print, no-download, record retention, and data-handling requirements, with IT Governance and Information Security.
• Monitor endpoint protection and CASB/Zscaler controls for third-party and offshore endpoints to confirm compliance with security…