StoneX Group Inc.→
Senior Manager, Third Party Risk… at StoneX Group… · US-IL-Chi…
Job Description
Senior Manager, Third Party Risk Management
Overview
Connecting clients to markets – and talent to opportunity.
With 5,400+ employees and over 80,000 institutional, commercial, and payments clients, we operate from more than 80 offices spread across six continents. As a Fortune 100, Nasdaq-listed provider, we connect clients to the global markets – focusing on innovation, human connection, and providing world-class products and services to all types of investors.
Whether you want to forge a career connecting our retail clients to potential trading opportunities, or ingrain yourself in the world of institutional investing, StoneX Group is made up of four business segments that offer endless potential for progression and growth.
Business Segment Overview
Corporate: Engage in a deep variety of business-critical activities that keep our company running efficiently. From strategic marketing and financial management to human resources and operational oversight, you’ll have the opportunity to optimize processes and implement game-changing policies.
Position purpose: StoneX Group Inc. is seeking an experienced Senior Manager - Third Party Risk Management (TPRM) to lead the program for all global legal entities out of our Chicago office. Reporting to the Global Head of Enterprise Risk, this is a senior Second Line of Defense (2LOD) role responsible for the design, oversight and continuous improvement of the framework across the Firm’s regulated activities.
The Senior Manager - TPRM is responsible for overseeing the design, implementation, ongoing enhancement, reporting, and maturity of the organization's enterprise-wide TPRM program. The role provides strategic and operational leadership across the full third-party lifecycle, ensuring that risks associated with third parties, suppliers, outsourcing arrangements, and other external relationships are identified, assessed, managed, monitored, and reported in accordance with the organization's risk appetite, policies, regulatory obligations, and business objectives.
The Senior Manager will serve as a key TPRM subject matter expert and will partner closely with Business Owners, Procurement, Legal, Compliance, Information Security, Privacy, Business Resilience, Finance, and other risk and control functions to maintain a consistent, risk-based, scalable, and sustainable TPRM framework.
This role is expected to move the program beyond transactional risk assessment activities by establishing strong governance, meaningful risk reporting, effective challenge, ongoing monitoring, technology-enabled processes, and a defined maturity roadmap that demonstrates continuous improvement and effective risk management throughout the third-party lifecycle.
Responsibilities
Primary duties will include:
TPRM Program Strategy, Design & Maturity
- Own and drive the ongoing design, implementation, enhancement, and maturity of the enterprise TPRM program.
- Develop and maintain a multi-year TPRM strategy and maturity roadmap aligned with organizational priorities, risk appetite, regulatory expectations, and industry practices.
- Periodically assess the program against regulatory requirements, internal standards, industry frameworks, audit findings, risk events, and identified areas for improvement.
- Identify opportunities to simplify, standardize, automate, and strengthen TPRM processes while maintaining appropriate risk coverage.
- Establish program maturity metrics and demonstrate measurable improvement in TPRM capabilities and outcomes.
- Lead strategic initiatives to address regulatory findings, audit observations, control deficiencies, and broader program enhancements.
Third Party Lifecycle Management
- Oversee the risk management framework across the entire third-party lifecycle, including:
- Business need and initial engagement
- Pre-contract due diligence
- Risk identification and inherent risk assessment
- Third-party segmentation and criticality determination
- Risk-domain assessments and due diligence
- Risk acceptance and approval
- Contractual risk requirements
- Onboarding
- Ongoing monitoring
- Periodic reassessment
- Issue and remediation management
- Change management
- Renewal
- Offboarding and termination
- Ensure that lifecycle requirements are risk-based and proportionate, including enhanced requirements for critical, material, high-risk, outsourced, or otherwise significant third-party relationships.
Governance, Framework & Policy Management
- Maintain the enterprise TPRM framework, policy, standards, procedures, methodologies, and supporting documentation.
- Establish clear roles, responsibilities, decision rights, escalation requirements, and accountability across the TPRM operating model.
- Ensure TPRM requirements are appropriately embedded within broader procurement, contracting, sourcing, operational risk, and business processes.
- Chair or support relevant TPRM governance forums and provide meaningful risk information to management and risk committees.
- Establish appropriate escalation mechanisms for material third-party risks, overdue assessments, remediation activities, policy exceptions, concentration risks, and other emerging concerns.
- Promote consistent application of TPRM requirements across business units, legal entities, and geographic regions.
Risk Assessment & Effective Challenge
- Oversee the methodology for assessing third-party risks across relevant risk domains, including, as applicable:
- Information and cyber security
- Data privacy and protection
- Operational resilience and business continuity
- Financial viability
- Regulatory and compliance risk
- Legal and contractual risk
- Concentration and dependency risk
- 4th/nth subcontractor risk
- Geographic and country risk
- Reputational risk
- Technology and cloud risk
- Provide effective challenge to business owners and subject matter experts where third-party risks are not appropriately identified, assessed, accepted, mitigated, or monitored.
- Ensure material residual risks and exceptions are escalated to the appropriate risk acceptance authority.
- Maintain oversight of third-party issues and remediation plans through closure.
Critical Third Parties, Outsourcing & Concentration Risk
- Maintain appropriate methodologies for identifying critical, material, and high-risk third parties and outsourcing arrangements.
- Oversee enhanced due diligence and monitoring requirements for higher-risk relationships.
- Develop and enhance the organization's approach to identifying and monitoring third-party concentration, geographic, technology, service-provider, and systemic dependencies.
- Partner with Operational Resilience and Business Continuity teams to evaluate third parties supporting critical or important business services.
- Ensure appropriate exit strategies, contingency arrangements, and resilience considerations are incorporated into the management of critical third parties.
Ongoing Monitoring & Risk Intelligence
- Develop and oversee a comprehensive ongoing monitoring framework for third-party relationships.
- Incorporate internal and external risk indicators, assessment results, incidents, financial condition, cybersecurity developments, service performance, regulatory developments, and other relevant information into monitoring activities.
- Define triggers for reassessment, escalation, remediation, and enhanced monitoring.
- Establish mechanisms for identifying emerging third-party risks and evaluating their potential impact across the organization's third-party portfolio.
Management Information, Reporting & Analytics
- Own the development and delivery of TPRM management information, Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), dashboards, and executive reporting.
- Establish reporting that provides clear insight into:
- Third-party population and risk profile
- Critical and high-risk third parties
- Due diligence and assessment status
- Overdue assessments and reviews
- Open findings and remediation activities
- Policy exceptions and risk acceptances
- Concentration and dependency risks
- Third-party incidents
- Regulatory and audit commitments
- Program performance and maturity
- Provide concise, decision-useful reporting to executive management, risk committees, and other governance forums.
- Use trend analysis and portfolio-level insights to proactively identify areas of elevated or emerging risk.
Technology, Data & Process Optimization
- Provide business ownership and strategic direction for TPRM technology, workflow, and data capabilities.
- Drive automation and process optimization to improve efficiency, scalability, data quality, and user experience.
- Define data standards and controls necessary to maintain a complete, accurate, and reliable third-party inventory.
- Partner with Technology and other stakeholders to implement enhancements to TPRM platforms and integrations.
- Promote a data-driven approach to third-party risk identification, monitoring, reporting, and decision-making.
Regulatory, Audit & Assurance Management
- Maintain awareness of evolving third-party, outsourcing, operational resilience, technology, cybersecurity, and supplier risk requirements across applicable jurisdictions.
- Coordinate TPRM responses to regulatory inquiries, examinations, internal audits, independent reviews, and compliance assessments.
- Oversee remediation of regulatory, audit, and assurance findings and provide appropriate evidence of sustainable closure.
- Maintain program documentation and evidence sufficient to demonstrate the design and operating effectiveness of the TPRM framework.
- Partner with independent assurance functions to identify and address opportunities for continuous improvement.
Stakeholder & Business Partnership
- Act as a trusted TPRM advisor to senior management, business leaders, procurement teams, and risk and control functions.
- Establish clear accountability for third-party risk ownership within the business.
- Build strong relationships across Procurement, Legal, Compliance, Technology, Information Security, Privacy, Operational Resilience, Finance, and Enterprise Risk.
- Provide guidance on complex or elevated third-party engagements and facilitate appropriate risk-based decision-making.
- Develop training, guidance, and communications to strengthen third-party risk awareness and accountability across the organization.
Team Leadership & Capability Development
- Lead, coach, and develop TPRM professionals and support the development of a high-performing risk team.
- Establish clear objectives, responsibilities, performance expectations, and development opportunities.
- Ensure adequate capability and capacity exist to support program requirements and strategic priorities.
- Promote a culture of ownership, effective challenge, collaboration, continuous improvement, and sound risk judgment.
Qualifications
To land this role you will need:
- 5-8 years of experience in Third Party Risk Management, Operational Risk, Supplier Risk, Procurement Risk, or a related discipline.
- Demonstrated experience designing, implementing, enhancing, or managing an enterprise TPRM framework.
- Strong understanding of the end-to-end third-party lifecycle and the associated governance, risk, and control requirements.
- Experience developing risk methodologies, policies, standards, procedures, governance, and management reporting.
- Experience managing complex risk remediation or program transformation initiatives.
- Strong knowledge of third-party risk assessment, ongoing monitoring, criticality methodology, issue management, and risk acceptance.
- Experience interacting with senior management, internal audit, compliance, regulators, or independent assurance functions.
- Demonstrated ability to lead cross-functional initiatives and influence stakeholders outside of direct reporting lines.
- Strong written and verbal communication skills, including the ability to translate complex risk matters into concise executive-level reporting.
What makes you stand out:
- Experience within a financial services or other highly regulated environment.
- Experience supporting global or multi-jurisdictional TPRM programs.
- Knowledge of outsourcing, operational resilience, ICT risk, cybersecurity, privacy, and concentration risk requirements.
- Experience implementing or enhancing TPRM/GRC technology platforms and workflow automation.
- Experience developing TPRM dashboards, KRIs, KPIs, risk appetite metrics, and Board or executive reporting.
- Relevant professional certifications such as CRISC, CISA, CISM, CISSP, CTPRP, CBCP, or equivalent risk, security, audit, or third-party risk credentials are advantageous.
Education / Certification Requirements:
- Bachelor's degree in Risk Management, Business, Accounting, Finance, or a related discipline, or equivalent professional experience.
Working Style:
- 4 days per week onsite, 1 day per week remote
Key Competencies
- Strategic Program Leadership – Able to establish a long-term vision for TPRM and translate strategy into practical implementation.
- Risk Judgment & Effective Challenge – Applies sound judgment and constructively challenges risk decisions where appropriate.
- Program Transformation – Demonstrated ability to mature programs through sustainable process, governance, technology, and control improvements.
- Regulatory Mindset – Understands how to translate regulatory expectations into practical and demonstrable risk management capabilities.
- Executive Communication – Presents complex third-party risk matters clearly and succinctly to senior stakeholders.
- Data & Analytical Thinking – Uses data and risk intelligence to identify trends, emerging risks, and areas requiring management attention.
- Cross-Functional Influence – Builds alignment and accountability across diverse business and control functions.
- Execution & Accountability – Drives initiatives through implementation and sustainable closure rather than focusing solely on framework design.
- Continuous Improvement – Proactively identifies opportunities to strengthen effectiveness, efficiency, scalability, and program maturity.
Hiring Salary Range $155,000 - $170,000. Salary to be determined by the education, experience, knowledge, skills and abilities of the applicant, internal equity and alignment with market data.) Subject to business performance and recommendations of management, this role may be eligible to participate in an incentive compensation plan. This compensation package, in addition to a full range of medical, financial, and/or other benefits, dependent on the position, is offered.
Options
Software Powered by ICIMS
www.icims.com