Director of Third Party Risk Management

Overview

The Director of Third-Party Risk Management is responsible for the overall leadership and effectiveness of the Company’s Third-Party Risk Management Program. This role oversees the end-to-end third party and contract lifecycle, ensures compliance with regulatory expectations and Company policy, leads enterprise third party risk governance activities, and partners across business units to identify, assess, monitor, and mitigate third party risk while balancing business objectives and operational needs.

Position Goals: Ensure the Third-Party Risk Management Program operates effectively and remains aligned with regulatory expectations, industry standards, and Company policies. Oversee the identification, assessment, monitoring, and mitigation of risks associated with third party relationships throughout their lifecycle.

Maintain a consistent and effective risk-based contract management framework that supports risk-based review, negotiation, administration, and renewal processes. Provide meaningful governance, reporting, training, and communication to support organizational awareness and informed risk oversight. Drive continuous improvement of third-party risk management processes, systems, and stakeholder collaboration across the organization.

Continuous professional education/development to remain up-to-date on applicable regulatory expectations and best practices in the TPRM field. Flexible Location : This is an in-office position, five (5) days per week, located at our office in Wyomissing, PA. Tompkins also maintains administrative offices in Ithaca, New York; Brewster, New York; Rochester, New York; and Syracuse, New York.

Responsibilities

Third Party Risk Program Leadership Direct, oversee, and coordinate the Company’s third-party risk management program. Lead the Third-Party Risk Management Committee and support enterprise-wide governance activities. Create policies, procedures, and program practices which align with evolving regulatory guidance and industry expectations.

Third Party Lifecycle Oversight Oversee onboarding, due diligence, risk assessment, ongoing monitoring, issue management, and offboarding activities for third parties. Manage cross-functional risk review workflows across applicable disciplines and stakeholders. Manage annual risk assessments and ongoing due diligence requirements.

Stakeholder Collaboration & Training Partner with relationship managers, business units, Procurement, Accounts Payable, and other stakeholders to support effective third-party oversight. Deliver communication, awareness, and training programs related to third party and contract management requirements. Manage information sharing and coordination among risk owners and business partners Risk Reporting & Continuous Improvement Prepare and present risk reports, assessments, trends, and program updates to committees, Corporate Risk, and the Board.

Monitor service level reviews and address identified issues with third parties. Identify and implement opportunities to improve program effectiveness, efficiency, and risk management practices. Key Success Factors: Risk Management: Provides strategic risk leadership by defining risk tolerance, guiding risk frameworks, and shaping short- and long-term risk strategies .

Strategic Leadership & Execution: Leads departmental strategic planning by setting clear objectives, anticipating challenges, developing actionable plans, and sustaining execution Influence: Influences strategically by aligning stakeholder interests, leveraging relationships, navigating organizational dynamics, and building support for business outcomes.

Planning & Results Orientation: Establishes goals, manages resources and budgets, addresses challenges, monitors progress, and maintains high standards. Communication: Fosters communication by engaging stakeholders with empathy and professionalism, adapting messaging to diverse perspectives, and coaching others to strengthen communication skills.

Qualifications

Bachelor’s degree in a relevant field. Minimum of eight (8) years of experience with third party risk management methodologies and regulatory guidance. Cybersecurity and/or information security experience preferred. Paralegal experience or contract negotiation experience required. Ability to assess third party financial statements and evaluate risks associated with vendor relationships.

Ability to think abstractly and understand risks presented within third party relationships. Visual Basic and/or SQL database programming skills preferred. Demonstrated ability to build partnerships and consult effectively across business lines and functional groups. Knowledge of business operations, support functions, and organizational risk environments.

Excellent interpersonal, verbal, and written communication skills with the ability to interact effectively at all organizational levels. Ability to drive process improvements and organizational change while managing milestones and deadlines. Current knowledge of third-party risk requirements, regulatory expectations, industry trends, and oversight practices.

Project management experience. Advanced proficiency in Microsoft Office applications.

Benefits

Medical Dental Vision 401(k) Match Profit Sharing Paid Time Off 11 Holidays Tuition Reimbursement Free Parking throughout Tompkins Bank & Trust Employee Referrals EEO Statement Tompkins is committed to a policy of Equal Employment Opportunity ("EEO") with respect to all team members and applicants for employment and a work environment free from discrimination (including unlawful harassment) based on race, color, religion, sex, sexual orientation, transgender status, gender non-conformity, gender identity, gender expression, national origin, age, marital status, domestic violence victim status, disability, predisposing genetic characteristics, military or veteran status or status in any group protected by federal, state, or local law.

For more information, please click here #communitybank #LI-ONSITE Pay Range USD $165,000.00

• USD $220,000.00 /Yr. Third Party Risk Program Leadership Direct, oversee, and coordinate the Company’s third-party risk management program. Lead the Third-Party Risk Management Committee and support enterprise-wide governance activities. Create policies, procedures, and program practices which align with evolving regulatory guidance and industry expectations. Third Party Lifecycle Oversight Oversee onboarding, due diligence, risk assessment, ongoing monitoring, issue management, and offboarding activities for third parties. Manage cross-functional risk review workflows across applicable disciplines and stakeholders. Manage annual risk assessments and ongoing due diligence requirements. Stakeholder Collaboration & Training Partner with relationship managers, business units, Procurement, Accounts Payable, and other stakeholders to support effective third-party oversight. Deliver communication, awareness, and training programs related to third party and contract management requirements. Manage information sharing and coordination among risk owners and business partners Risk Reporting & Continuous Improvement Prepare and present risk reports, assessments, trends, and program updates to committees, Corporate Risk, and the Board. Monitor service level reviews and address identified issues with third parties. Identify and implement opportunities to improve program effectiveness, efficiency, and risk management practices. Key Success Factors: Risk Management: Provides strategic risk leadership by defining risk tolerance, guiding risk frameworks, and shaping short- and long-term risk strategies . Strategic Leadership & Execution: Leads departmental strategic planning by setting clear objectives, anticipating challenges, developing actionable plans, and sustaining execution Influence: Influences strategically by aligning stakeholder interests, leveraging relationships, navigating organizational dynamics, and building support for business outcomes. Planning & Results Orientation: Establishes goals, manages resources and budgets, addresses challenges, monitors progress, and maintains high standards. Communication: Fosters communication by engaging stakeholders with empathy and professionalism, adapting messaging to diverse perspectives, and coaching others to strengthen communication skills. Bachelor’s degree in a relevant field. Minimum of eight (8) years of experience with third party risk management methodologies and regulatory guidance. Cybersecurity and/or information security experience preferred. Paralegal experience or contract negotiation experience required. Ability to assess third party financial statements and evaluate risks associated with vendor relationships. Ability to think abstractly and understand risks presented within third party relationships. Visual Basic and/or SQL database programming skills preferred. Demonstrated ability to build partnerships and consult effectively across business lines and functional groups. Knowledge of business operations, support functions, and organizational risk environments. Excellent interpersonal, verbal, and written communication skills with the ability to interact effectively at all organizational levels. Ability to drive process improvements and organizational change while managing milestones and deadlines. Current knowledge of third-party risk requirements, regulatory expectations, industry trends, and oversight practices. Project management experience. Advanced proficiency in Microsoft Office applications.