Vendor Risk Management Officer

Sabadell Overview Sabadell is a global financial institution headquartered in Barcelona, Spain and one of Europe’s oldest and most successful banking groups since its founding in 1881. Sabadell covers all areas of the financial business sector under a common denominator: professional performance and quality. In the United States, Sabadell has operated with an International Full Branch since 1993. We offer Corporate Banking services to international companies in the American market, and Private Banking services primarily to Latin American high net worth individuals and families. Banco Sabadell is seeking a Vendor Risk Management Officer candidate to join a dynamic team within one of the fastest growing banks in Florida. Essential Duties and Responsibilitie s VRM Program Execution and Governance Execute the day-to-day requirements, procedures, workflows, and control activities of the Vendor Risk Management program under the direction of the CISO. Serve as the day-to-day liaison with the Head Office VRM Department for program expectations, reporting, methodology alignment, and issue escalation. Maintain and improve the VRM calendar covering onboarding, periodic reviews, VMOR activities, risk reassessments, committee deliverables, audit requests, and reporting deadlines. Track program obligations, follow up with accountable parties, document completion, and escalate delays or material issues. Analyze control gaps, process efficiency, and risk trends and recommend program improvements to the CISO; management retains approval of policy changes, exceptions, and risk acceptance. Vendor Onboarding and Due Diligence Coordinate new-vendor onboarding through the Bank’s approved VRM workflow tool, currently Venminder/NContracts, or any successor platform. Work with business owners and subject-matter experts to obtain information-security, business-continuity, privacy, compliance, financial, operational, and contractual due diligence. Review submissions for completeness and consistency and drive follow-up with business owners, vendors, and internal reviewers. Perform or coordinate inherent-risk assessments, risk tiering, and control reviews based on vendor criticality, data exposure, regulatory impact, service dependency, and scope. Confirm required approvals are documented before onboarding or renewal and escalate unresolved findings, exceptions, or residual-risk decisions to the appropriate approver. Periodic Reviews, VMOR, and Ongoing Monitoring Coordinate the annual VMOR process with business owners, risk contributors, and control partners. Complete periodic reviews to confirm vendor use remains consistent with the executed agreement, approved service scope, risk rating, and control expectations. Prepare and maintain User Consideration Forms or equivalent evidence of ongoing review and oversight. Monitor vendor alerts, risk intelligence, service changes, control issues, contract expirations, and other reassessment triggers. Track remediation plans, findings, risk acceptances, exceptions, and overdue actions through closure; escalate aging, high-risk, or disputed items to the CISO and relevant governance forum. Audit, Regulatory, and Evidence Management Support internal audit, external audit, regulatory, and Head Office requests concerning VRM and third-party oversight. Maintain complete, organized, and audit-ready evidence for onboarding, due diligence, contracts, periodic reviews, control assessments, approvals, risk decisions, and remediation. Coordinate evidence collection with business owners, Operational Risk Management, Financial Risk Management, Information Security, Procurement, Legal, Compliance, and other stakeholders. Identify recurring findings, documentation gaps, and process weaknesses and recommend corrective actions to the CISO. Prepare status updates, draft management responses, and supporting materials for VRM observations, issue tracking, and closure validation, subject to management review. DORA, Concentr…

View the full posting and apply