IT Third-Party Risk Assessor

Do you want your voice heard and your actions to count? Discover your opportunity with Mitsubishi UFJ Financial Group (MUFG), one of the world’s leading financial groups. Across the globe, we’re 150,000 colleagues, striving to make a difference for every client, organization, and community we serve. We stand for our values, building long-term relationships, serving society, and fostering shared and sustainable growth for a better world.

With a vision to be the world’s most trusted financial group, it’s part of our culture to put people first, listen to new and diverse ideas and collaborate toward greater innovation, speed and agility. This means investing in talent, technologies, and tools that empower you to own your career.

Join MUFG, where being inspired is expected and making a meaningful impact is rewarded.

The selected colleague will work at an MUFG office or client sites four days per week and work remotely one day. A member of our recruitment team will provide more details.

The IT Third-Party Risk Assessor is responsible for evaluating, monitoring, and reporting on information technology risks associated with third-party vendors, suppliers, service providers, and other external business partners. This role supports the organization's Third-Party Risk Management (TPRM) program by conducting risk assessments, reviewing cybersecurity controls, identifying potential vulnerabilities, and ensuring third parties comply with organizational policies, industry standards, and regulatory requirements.

The successful candidate will evaluate the information security and technology frameworks of external partners, SaaS providers, and financial technology associates. This position enforces strict alignment with banking regulations, manages risk life cycles inside Archer, and leverages AI technologies to accelerate due diligence and continuous monitoring. TPRM SME will partner with business stakeholders, procurement / contract management teams, security teams, compliance functions, and vendors to identify and mitigate risks throughout the third-party lifecycle.

Key Responsibilities Third-Party Risk Assessments Conduct cybersecurity, information security, and technology risk assessments of third-party vendors and service providers.

Review vendor security documentation, including:

SIG questionnairesSOC 1 and SOC 2 reports (may include Bridge Letter verification)
ISO 27001 certifications to include SoA reviews

Archer Management:
Track, document, and manage the end-to-end vendor risk lifecycle within Archer GRC.AI Tool Integration:
Use AI-powered risk platforms to parse vendor documentation and summarize control gaps.

Security policies and procedures

Assess inherent and residual risks associated with third-party relationships.

Evaluate vendor compliance with internal policies, security standards, and regulatory requirements.

Risk Analysis and Reporting Identify and document control gaps, vulnerabilities, and areas of concern.

Develop risk ratings and provide recommendations for risk mitigation.

Prepare concise risk assessment reports and executive-level summaries.

Present assessment findings to business owners, risk committees, and senior management.

Ongoing Monitoring Perform periodic reassessments of critical and high-risk vendors.

Monitor vendors for cybersecurity incidents, financial instability, regulatory actions, and emerging risks.

Track remediation activities and validate corrective actions.

Maintain vendor risk profiles and assessment documentation.

Stakeholder Collaboration Partner with Procurement, Information Security, Legal, Compliance, Privacy, and Business Units throughout the vendor lifecycle.

Provide guidance regarding security requirements during vendor onboarding and renewals.

Support contract…