Commercial and Investment Bank, Controls - Third Party and Resiliency Risk & Control Manager - Executive Director

JOB DESCRIPTION

Help shape how we make confident, well-governed decisions about third-party risk across a large, complex vendor ecosystem. You'll turn technical assessment outputs into clear, executive-ready insights that protect clients, data, and operations. In this role, you will influence how we identify emerging risk patterns, prioritize remediation, and set consistent control expectations. You'll partner across risk, technology, legal, procurement, and compliance in a highly visible role with meaningful impact.

As an Executive Director in Third-Party Risk and Controls Insights within the Commercial and Investment Bank, you will synthesize, challenge, and communicate key risks and control considerations across the third-party lifecycle (onboarding, change, ongoing monitoring, and exit). You will ensure risk conclusions and decision artifacts are consistent, defensible, and aligned to agreed standards, thresholds, and risk appetite. You will translate vendor security evidence into clear risk narratives, business impact, and actionable recommendations. You will help leaders make informed decisions on risk acceptance, remediation prioritization, and safe vendor adoption.

Job responsibilities 

• Aggregate and analyze third-party risk signals with a focus on data protection, cybersecurity, and operational resilience, translating findings into business process impacts and operational risk outcomes.
• Set and govern standards for risk statements, residual risk framing, materiality thresholds, issue taxonomy, and escalation expectations across the third-party lifecycle.
• Own quality assurance and constructive challenge of third-party assessment and monitoring outputs to ensure completeness, consistency, and defensibility of conclusions and remediation expectations.
• Identify and elevate themes across the third-party portfolio (recurring control gaps, common failure modes, concentration hot spots) through appropriate governance forums.
• Produce decision-grade materials that clearly articulate residual risk, recommended mitigations, and defined decision points tailored to business criticality.
• Review and advise on business cases for new or expanded third-party engagements, including opportunities to reuse existing vendors and standardize controls or contractual levers.
• Interpret vendor security evidence (for example, SOC 2 reports, ISO 27001 certification, and industry questionnaires such as Standardized Information Gathering (SIG) and the Consensus Assessments Initiative Questionnaire (CAIQ)) and convert it into clear risk narratives and control gap assessments.
• Evaluate cloud and software-as-a-service architectures to identify material risks (identity and access management, encryption/key management, logging/monitoring, segmentation, data residency, dependency chains, and concentration risk).
• Define and maintain a risk insights framework, including risk taxonomy mapping, key risk/key performance indicators, thresholds, trends, and executive-ready reporting.
• Drive consistency in issue management by setting expectations for classification, documentation quality, evidence standards for closure, and transparent reporting of overdue actions and residual risk.
• Partner and influence across control management, technology, procurement, legal, compliance, and operational risk to maintain a single, consistent narrative and improve decision usefulness.

Required qualifications, capabilities and skills 

• 8 years of experience in control management, operational risk, technology risk, cybersecurity risk, or third-party risk within financial services or a similarly regulated industry.
• Demonstrated experience across the third-party lifecycle (onboarding, assessment, monitoring, issue management, and exit).
• Proven ability to synthesize assessment outputs into executive-ready insights, including themes, emerging risks, residual risk framing, and clear recommendations.
• Strong cybersecurity and technology risk fluency, including the ability to challenge vendor security posture using evidence such as SOC 2 and ISO 27001.
• Working knowledge of cloud and software-as-a-service control domains (identity and access management, encryption, logging/monitoring, vulnerability management, incident response, and secure development controls).
• Ability to translate technical risk into business decisions, including trade-offs, materiality, and practical mitigation actions.
• Experience defining and using key risk/key performance indicators, thresholds, and trend interpretation to drive risk visibility and prioritization.
• Strong stakeholder management skills, with the ability to influence cross-functional partners and challenge constructively when outputs are not decision-useful.
• Excellent written and verbal communication skills, including producing concise governance materials for senior stakeholders.

Preferred qualifications, capabilities and skills

• Experience building or running third-party risk portfolio reporting and governance routines, including taxonomy design, thresholds, and thematic reporting.
• Advanced knowledge of operational resilience practices (service mapping concepts, recovery expectations, dependency analysis, and vendor failure-mode translation).
• Experience using automation, analytics, and/or AI-enabled approaches to improve monitoring, signal detection, and insights generation (subject to approved tools and controls).
• Strong executive presence and facilitation skills to drive alignment on remediation priorities, timelines, and risk acceptance decisions.
• Strong quantitative and narrative capability to combine metrics with clear storytelling for senior decision-makers.
• Experience improving documentation and evidence standards for issue closure and audit-ready reporting.

ABOUT US

JPMorganChase, one of the oldest financial institutions, offers innovative financial solutions to millions of consumers, small businesses and many of the world's most prominent corporate, institutional and government clients under the J.P. Morgan and Chase brands. Our history spans over 200 years and today we are a leader in investment banking, consumer and small business banking, commercial banking, financial transaction processing and asset management.

We offer a competitive total rewards package including base salary determined based on the role, experience, skill set and location. Those in eligible roles may receive commission-based pay and/or discretionary incentive compensation, paid in the form of cash and/or forfeitable equity, awarded in recognition of individual achievements and contributions. We also offer a range of benefits and programs to meet employee needs, based on eligibility. These benefits include comprehensive health care coverage, on-site health and wellness centers, a retirement savings plan, backup childcare, tuition reimbursement, mental health support, financial coaching and more. Additional details about total compensation and benefits will be provided during the hiring process. 

We recognize that our people are our strength and the diverse talents they bring to our global workforce are directly linked to our success. We are an equal opportunity employer and place a high value on diversity and inclusion at our company. We do not discriminate on the basis of any protected attribute, including race, religion, color, national origin, gender, sexual orientation, gender identity, gender expression, age, marital or veteran status, pregnancy or disability, or any other basis protected under applicable law. We also make reasonable accommodations for applicants' and employees' religious practices and beliefs, as well as mental health or physical disability needs. Visit our FAQs for more information about requesting an accommodation.

JPMorgan Chase & Co. is an Equal Opportunity Employer, including Disability/Veterans

ABOUT THE TEAM

J.P. Morgan's Commercial & Investment Bank is a global leader across banking, markets, securities services and payments. Corporations, governments and institutions throughout the world entrust us with their business in more than 100 countries. The Commercial & Investment Bank provides strategic advice, raises capital, manages risk and extends liquidity in markets around the world.