Director, Third-Party Risk Management

Join our team and build your career with momentum as we champion your growth, elevate your ideas and engage you in purpose-driven work that makes a real difference every day.

Who we are Founded in 1997, Merrick Bank is an FDIC-insured financial institution headquartered in South Jordan, Utah, with over $10 billion in assets. A wholly owned subsidiary of Card Works Financial Group, Merrick Bank serves roughly five million card members and more than 100,000 merchant customers nationwide.

What we doWe provide credit cards, recreational loans, deposit accounts, merchant services and bank sponsor ships to consumers and businesses. As a leader in non-prime lending and merchant acquiring, we combine innovative technology with data-driven insights to help underserved consumers build and strengthen credit while delivering integrated, scalable payment solutions for businesses.

Merrick Bank ranks among the top 20 FDIC-insured credit card issuers in the U.S. and among the top 15 merchant acquirers by transaction volume.

Position Summary and Role Impact:

The Director, Third-Party Risk Management (TPRM), is a second-line risk leader responsible for directing the execution, oversight, and continuous enhancement of Merrick Bank’s (the “Bank”) TPRM Program. The role provides independent review and challenge across the third-party lifecycle, translates third-party risk information into decision-useful insights, and drives timely escalation and remediation of material exposures. This role partners with senior management, Vendor Relationship Owners, Vendor Management, Legal, Information Security, Compliance, Internal Audit, and other first- and second-line stakeholders to promote consistent, risk-based decisions aligned with regulatory requirements, internal policies, and the Bank’s risk appetite.

Essential Functions:

Directs the execution and continuous enhancement of the Bank’s TPRM framework across planning, due diligence, selection, contracting, ongoing monitoring, issue management, renewal, and termination, ensuring practices are risk-based, scalable, and aligned with regulatory expectations and internal governance standards.

Provides leadership, direction, workload prioritization, coaching, and performance oversight to TPRM team members and functional resources supporting assessments, monitoring, issue management, reporting, and program improvement.

Oversees and, when needed, performs risk-based due diligence, risk assessments, control evaluations, and ongoing monitoring across the third-party lifecycle, ensuring work is timely, evidence-based, consistently documented, and commensurate with the relationship’s risk and criticality.

Partners with business units, Vendor Relationship Owners, Vendor Engagement Leads, Vendor Management, and Subject Matter Experts to clarify first- and second-line accountabilities; identify, assess, monitor, and mitigate third-party risks; and ensure material changes in scope, performance, or risk profile are evaluated and escalated.

Provides independent review and effective challenge of third-party risk assessments, risk ratings, exceptions, control conclusions, and proposed risk responses; documents the basis for challenge and escalates matters that exceed defined thresholds, risk appetite, or approval authority.

Oversees monitoring of third-party performance, financial condition, control effectiveness, risk indicators, complaints, incidents, concentration risk, issues, and remediation commitments; identifies trends and emerging risks and escalates material concerns to ERM leadership and applicable governance forums.

Leads the development, maintenance, and periodic review of TPRM policies, standards, procedures, methodologies, and workflows to sustain a consistent enterprise…