Third Party Risk Manager - Mercury

As Mercury prepares to become a bank, our Third Party Risk Management (TPRM) program is in active development to meet bank-level regulatory expectations. As an early member of a growing TPRM team, you’ll help run the program day-to-day and contribute to how it matures, bringing your own judgment and point of view to a function that is usually more rigidly defined.

Reporting to the Senior Manager, Third Party Risk Management, you will conduct third-party risk assessments, build out risk reporting, and carry out second-line oversight activities across the enterprise.

This position focuses on enterprise-wide TPRM, working closely with subject-matter experts across Compliance, Information Security, Privacy, and Procurement to ensure requirements are reflected across the full third-party lifecycle.

Key Responsibilities

• Assess and risk rate: Complete third-party risk assessments, risk rate third parties, and track issues through resolution.
• Second-line oversight: Review and challenge first-line due diligence and ongoing monitoring, including reporting, approvals, and oversight activities.
• Reporting and data: Maintain third-party risk reporting and metrics for management and governance forums while keeping underlying data accurate.
• Tooling and automation: Help implement tooling and automation to streamline risk processes.
• Program uplift: Support efforts to update policies, due diligence processes, and risk management practices across the third-party lifecycle.

Required Qualifications

• 4+ years of third-party risk management experience, including 2+ years in a regulated financial services environment (bank, or fintech working with bank partners).
• Working knowledge of regulatory guidance on third-party risk, including the Interagency Guidance on Third Party Relationships (and related FFIEC, OCC, and FDIC expectations).
• Hands-on experience completing third-party risk assessments across multiple risk domains beyond security.
• Experience reviewing and challenging first-line risk work with evidence-based pushback.
• Experience supporting audits or exams of a TPRM program.
• Experience building or maintaining TPRM reporting and metrics with high data accuracy.
• Solid program and project management skills driving process improvements to implementation.
• Proven ability to influence cross-functional partners (Procurement, Finance, InfoSec, Legal, Privacy) without direct authority.
• Clear communicator who can articulate and hold a risk position under pushback.

Preferred Qualifications

• Experience at a bank, or a fintech transitioning toward banking.
• Experience improving or uplifting an existing TPRM program.
• Experience with TPRM tooling, automation, or AI-enabled workflows.
• Familiarity with enterprise risk concepts (risk register, risk appetite, committee reporting).
• Relevant professional certification (e.g., CISA, CGRC).

About Mercury

Mercury is a fintech company, not an FDIC-insured bank. Banking services provided through Choice Financial Group and Column N.A., Members FDIC.