Tech Risk - Third Party Lead

The Tech Risk - Third Party Lead at JP Morgan Chase within Cybersecurity and Tech Controls, leads oversight and continuous improvement within third-party cyber assessment capability and broader third-party assurance program. You'll define and execute the third-party assurance strategy and help shape the operating model, priorities, and roadmap, translating strategy into scalable processes, clear governance, and measurable outcomes. You will focus on meeting executive stakeholder expectations through high-quality reporting, metrics, and risk insights; identifies themes and emerging risks; and drives remediation, policy/standard alignment, and process enhancements to strengthen end-to-end third-party risk management practices. . You will play a crucial role in fostering a robust risk culture and catalyzing continuous improvement, contributing to the development and implementation of comprehensive risk management policies, standards, and controls.

Job Responsibilities

• Lead efforts to strengthen the firm’s third-party risk assessment and control environment, identifying areas for improvement and advising on control implementation to mitigate thematic risks.
• Influence, drive, and oversee the efficient execution of third party assurance programs, ensuring alignment with organizational objectives, risk appetite, and regulatory compliance, while continuously updating requirements to address evolving threats and regulatory changes.
• Prepare and deliver reports and metrics to provide insights into risk trends and program effectiveness, engaging with stakeholders to communicate the status of third-party cyber and technology risks.
• Collaborate with Control Owners to establish and uphold clear cyber, technology, and data control requirements for all third-party relationships.
• Act as a liaison to Global Supplier Services, Tech Risk and Controls, Product Security, Business Control Managers, and GRC leads to foster a collaborative approach to third-party risk management.
• Uses enterprise-authorized AI capabilities within the work environment to accelerate synthesis of risk/control evidence and draft executive-ready reporting, validating outputs and handling data according to sensitivity and security requirements
• Promotes reuse-first, AI-assisted approaches to streamline recurring control testing and issue/action-plan management routines, ensuring human review and alignment to auditability and regulatory expectations
• Stay abreast of industry developments, emerging threats, and best practices to ensure the program remains cutting-edge.

Required qualifications, capabilities, and skills

• Obtain 5 plus years of experience in third-party risk management, cybersecurity, technology risk, or related disciplines and/or Bachelor’s degree in Information Security, Cybersecurity, Risk Management, Business Administration, or related field; Master’s degree a plus
• Experience in a highly regulated industry (e.g., financial services, healthcare) is strongly preferred.
• Proven ability to lead cross-functional teams, influence senior stakeholders, and drive strategic initiatives.
• Deep understanding of third-party risk management frameworks, cybersecurity controls, and regulatory requirements (e.g., OCC, FFIEC, GDPR, ISO 27001, NIST), experience utilizing a range of GRC (Governance, Risk, and Compliance) and data analytics platforms, such as Archer, ServiceNow, Alteryx, Tableau, and QlikView.
• Demonstrated experience using enterprise-authorized AI capabilities within the work environment to support technology risk and controls workflows with strong validation habits and awareness of data sensitivity.
• Ability to review and validate AI-assisted risk summaries and recommendations before use, escalating when uncertain and ensuring outcomes align to security, auditability, and regulatory expectations.
• Strong analytical skills with experience developing and presenting risk metrics, dashboards, and executive-level reports.
• Experience working with legal and procurement teams to negotiate and strengthen contractual provisions related to cybersecurity and data protection.
• Excellent interpersonal and communication skills, with the ability to build relationships and collaborate across business units and technical teams.
• Demonstrated ability to manage complex programs and projects, prioritize competing demands, and deliver results in a fast-paced environment.
• Commitment to continuous improvement, staying current with industry trends, emerging threats, and best practices.

Preferred qualifications, capabilities, and skills

• Certified Third Party Risk Professional (CTPRP), Certified Regulatory Vendor Program Manager (CRVPM), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC)
• Perform as a Strategic thinker with a hands-on approach
• Ability to work independently and as part of a team
• Adaptability to changing regulatory and business environments