Third Party Risk Manager (Fintech)

Location: San Francisco, CA; New York, NY; Portland, OR; or remote within Canada or the United States. Any office or remote.

Salary: USD 132,400–165,500 for US employees in New York City, Los Angeles, Seattle, or the San Francisco Bay Area; USD 119,200–149,000 for US employees elsewhere; CAD 125,100–156,400 for Canadian employees.

Company

Mercury is a fintech company developing banking services through partner banks and preparing to become a bank.

What you will do

• Complete third-party risk assessments, risk-rate third parties, and track issues through resolution.
• Review and challenge first-line due diligence and ongoing monitoring, including reporting, approvals, and oversight.
• Maintain third-party risk reporting, metrics, and accurate underlying data for management and governance forums.
• Help implement tooling and automation to improve process efficiency.
• Contribute to TPRM program uplift, including policies, due diligence, risk assessment processes, and lifecycle risk management.
• Partner with Compliance, Information Security, Privacy, Procurement, Finance, and Legal on enterprise-wide third-party risk.

Requirements

• 4+ years of third-party risk management experience, including 2+ years in a regulated financial services environment such as a bank or fintech working with bank partners.
• Working knowledge of regulatory guidance on third-party risk, including the Interagency Guidance on Third-Party Relationships and related FFIEC, OCC, and FDIC expectations.
• Knowledge of TPRM practices across planning, due diligence, contracting, monitoring, and termination.
• Hands-on experience completing third-party risk assessments across multiple risk domains, not only security.
• Experience reviewing and challenging first-line risk work with evidence-based pushback.
• Experience supporting TPRM audits or examinations by gathering evidence, responding to requests, and following up on findings.
• Experience building or maintaining TPRM reporting and metrics with attention to data accuracy.
• Solid program and project management skills, including cross-functional process improvement through implementation.
• Ability to influence Procurement, Finance, Information Security, Legal, and Privacy partners without direct authority, communicate clearly, and maintain a risk position under pushback.

Nice to have

• Experience at a bank or fintech moving toward banking.
• Experience improving or uplifting an existing TPRM program.
• Experience with TPRM tooling, automation, or AI-enabled workflows.
• Familiarity with enterprise risk concepts such as risk registers, risk appetite, and committee reporting.
• Relevant certification such as CISA or CGRC.

Culture & Benefits

• Office-based or remote work is available within Canada or the United States.
• Total rewards include base salary, equity through stock options or RSUs, and benefits.
• Compensation varies by experience, expertise, geographic location, and internal pay equity.
• Mercury is committed to diversity, belonging, equal employment opportunity, and reasonable accommodations during recruitment.