Head of Third-Party Management Operations (TPMO)

Job Level: Executive Director

Job Function: Governance & Assurance

Location:

New York, NY, US, 10172 Charlotte, NC, US, 28202

Employment Type: Full Time

Requisition ID: 7895

SMBC Group is a top-tier global financial group. Headquartered in Tokyo and with a 400-year history, SMBC Group offers a diverse range of financial services, including banking, leasing, securities, credit cards, and consumer finance. The Group has more than 130 offices and 80,000 employees worldwide in nearly 40 countries. Sumitomo Mitsui Financial Group, Inc. (SMFG) is the holding company of SMBC Group, which is one of the three largest banking groups in Japan. SMFG’s shares trade on the Tokyo, Nagoya, and New York (NYSE: SMFG) stock exchanges.

In the Americas, SMBC Group has a presence in the US, Canada, Mexico, Brazil, Chile, Colombia, and Peru. Backed by the capital strength of SMBC Group and the value of its relationships in Asia, the Group offers a range of commercial and investment banking services to its corporate, institutional, and municipal clients. It connects a diverse client base to local markets and the organization’s extensive global network. The Group’s operating companies in the Americas include Sumitomo Mitsui Banking Corp. (SMBC), SMBC Nikko Securities America, Inc., SMBC Capital Markets, Inc., SMBC MANUBANK, JRI America, Inc., SMBC Leasing and Finance, Inc., Banco Sumitomo Mitsui Brasileiro S.A., and Sumitomo Mitsui Finance and Leasing Co., Ltd.

The anticipated salary range for this role is between $215,000.00 and $250,000.00. The specific salary offered to an applicant will be based on their individual qualifications, experiences, and an analysis of the current compensation paid in their geography and the market for similar roles at the time of hire. The role may also be eligible for an annual discretionary incentive award. In addition to cash compensation, SMBC offers a competitive portfolio of benefits to its employees.

Role Description

The Head of Vendor Risk Management is responsible for leading the Bank's first line Third-Party Management Operations (TPMO) program across all business lines and corporate functions. This executive leadership role oversees the governance, framework, policies, and ongoing monitoring of third-party and affiliate risks to ensure compliance with regulatory expectations and alignment with the Bank’s risk appetite.

The role serves as the primary subject matter expert for vendor risk and is responsible for identifying, assessing, monitoring, and mitigating risks arising from external service providers, strategic partnerships, outsourcing arrangements, and critical third-party relationships. The Executive Director will partner closely with Technology, Information Security, Procurement, Legal, Compliance, Operational Risk, Internal Audit, Vendor Management and Business stakeholders to ensure a robust and effective vendor risk management framework.

Role Objectives

Leadership & Strategy

Lead the enterprise-wide Vendor Risk Management Program and establish the strategic vision as we work more globally including development of goals and target operating roadmap.
Drive continuous enhancement of the third-party risk framework, governance model, policies, standards, and procedures.
Serve as a trusted advisor to executive management and risk committees on emerging third-party risks and industry developments.
Build, develop, and mentor a high-performing team of vendor risk professionals.

Third-Party Risk Governance

Execute the Bank’s Third-Party Risk Management Framework, ensuring alignment with regulatory guidance and industry best practices.
Establish risk assessment methodologies and ongoing new ways of monitoring activities.
Define risk appetite statements, key risk indicators (KRIs), and reporting metrics for third-party risk exposures.
Oversee governance forums and escalation processes for critical vendor risks.

Risk Assessment & Monitoring

Oversee due diligence reviews for new and existing vendors, including financial, operational, cybersecurity, compliance, privacy, resiliency, and concentration risk assessments.
Ensure appropriate risk tiering of vendors and implementation of monitoring requirements based on risk levels.
Review findings, remediation plans, and risk acceptance decisions for material third-party relationships.
Monitor concentration risk and interdependencies among critical service providers.

Regulatory & Audit Management

Ensure compliance with applicable regulatory guidance, including OCC, Federal Reserve, FDIC, and other relevant third-party risk management requirements.
Lead regulatory examinations and internal/external audits related to vendor management programs.
Coordinate responses to regulatory findings, audit issues, and management action plans.

Stakeholder Management

Partner with Procurement, Legal, Compliance, Information Security, Business Continuity, Data Privacy, and Technology teams throughout the vendor lifecycle.
Provide regular reporting and strategic updates to executive leadership, risk committees, and governance forums.
Influence senior leaders across the organization to drive effective risk management practices.

Reporting & Analytics

Establish executive dashboards and management reporting on vendor risk exposures, issue remediation, concentration risks, and program effectiveness.
Leverage data analytics and automation capabilities to improve risk identification and decision-making.
Present vendor risk trends and emerging threats to executive committees and Board-level stakeholders

Qualifications and Skills

Education

Bachelor's degree required.
Advanced degree (MBA, MS, JD, or equivalent) preferred.

Experience

12+ years of experience in Vendor Risk Management, Third-Party Risk, Operational Risk, Enterprise Risk, Audit, Compliance, or related financial services functions.
Minimum of 7 years of leadership experience managing teams and enterprise-wide programs within a large financial institution.
Deep understanding of banking regulations, third-party risk frameworks, outsourcing risk management, and operational resilience.
Experience interacting with regulators, executive management, and Board committees.
Proven success building and enhancing enterprise risk programs.

Preferred Certifications

Certified Third Party Risk Professional (CTPRP)
Certified Information Systems Auditor (CISA)
Certified Risk Professional (CRP)
Certified Information Systems Security Professional (CISSP)
Project Management Professional (PMP)

#LI-RCH

Additional Requirements

SMBC’s employees participate in a Hybrid workforce model that provides employees with an opportunity to work from home, as well as, from an SMBC office. SMBC requires that employees live within a reasonable commuting distance of their office location. Prospective candidates will learn more about their specific hybrid work schedule during their interview process. Hybrid work may not be permitted for certain roles, including, for example, certain FINRA-registered roles for which in-office attendance for the entire workweek is required.

SMBC provides reasonable accommodations during candidacy for applicants with disabilities consistent with applicable federal, state, and local law. If you need a reasonable accommodation during the application process, please let us know at accommodations@smbcgroup.com.