Outsourcing, Third-Party Risk and Operational… at Union… · Luxembourg

MISSION

Union Bancaire Privée (Europe) SA, is looking for an experienced and proactive Outsourcing, Third-Party Risk & Operational Resilience Manager to oversee the Bank’s outsourcing, third-party risk management, procurement and operational resilience activities.

The role will cover the Bank and its branches, working closely with internal stakeholders, the Group Head Office, IT, Legal, Compliance, Data Protection, Risk and Business functions. Given the Bank’s significant reliance on outsourced IT and operational services, the position will play a key role in ensuring that outsourced activities remain properly governed, monitored, resilient and compliant with applicable regulatory requirements.

The successful candidate will also act as the Bank’s ESG correspondent for the Group and as the primary regulatory liaison for outsourcing-related matters.

MAIN RESPONSIBILITES

Outsourcing Management

• Manage the full life cycle of outsourced activities, from pre-outsourcing assessment and due diligence through to renewal, remediation or exit.
• Coordinate the assessment and selection of intra-group and external service providers.
• Work with Legal and relevant stakeholders to ensure that outsourcing agreements and service level agreements contain appropriate contractual protections.
• Monitor outsourced services against agreed SLAs, KPIs and KRIs, ensuring that performance issues are identified and addressed promptly.
• Conduct periodic risk assessments and due diligence reviews of service providers.
• Track corrective actions, contractual changes, incidents and remediation plans through to completion.
• Maintain and test exit plans for critical and important outsourced services, including annual tabletop exercises, knowledge-transfer arrangements and transition SLAs.
• Ensure compliance with applicable CSSF requirements, including CSSF Circular 22/806, as amended by CSSF Circular 25/883, as well as the Digital Operational Resilience Act (DORA).
• Oversee IT outsourcing activities in cooperation with the IT Department, including initial and periodic due diligence of ICT providers.
• Liaise with Group Head Office regarding sub-outsourcing arrangements and ensure that sub-outsourced services are appropriately monitored and compliant with local regulatory requirements.

Third-Party Risk Management

• Maintain third-party risk management frameworks, registers and supporting governance documentation.
• Develop and maintain dashboards covering service levels, incidents, change volumes, defects and remediation timelines.
• Monitor providers continuously and escalate material risks or performance concerns.
• Assess the financial health and viability of external vendors, including the identification of potential exit triggers.
• Monitor geopolitical, legal and jurisdictional risks relating to locations hosting critical data or services.
• Lead third-party concentration risk assessments, including intra-group, geographic and subcontracting concentration risks.
• Maintain and test exit-plans

Operational Resilience and DORA

• Map Important Business Services and their dependencies on outsourced and ICT components.
• Document impact tolerances and ensure that relevant dependencies are reflected in resilience assessments.
• Maintain the outsourcing incident taxonomy and incident register.
• Ensure timely escalation of incidents and appropriate regulatory notification routing.
• Coordinate business continuity and disaster recovery testing with Group Head Office and relevant internal stakeholders.
• Participate in periodic operational resilience, failover and scenario-based testing in close cooperation with the IT Department.
• Track testing findings and remediation actions through to closure.
• Coordinate the annual operational resilience self-assessment and prepare the related Board reporting pack.
• Act as a gatekeeper for changes affecting outsourced services, including new technologies, cloud migrations and material service changes.
• Ensure that security-by-design and privacy-by-design considerations are evidenced in project documentation.

Procurement

• Support business functions in selecting appropriate suppliers, in coordination with Group Head Office where applicable.
• Manage relationships with key suppliers and negotiate local commercial terms.
• Ensure that procurement processes are implemented consistently and comply with internal policies and applicable local regulations.
• Coordinate the local Procurement network for the Bank and its branches.

ESG and CSR

• Act as the Bank’s ESG correspondent for the Group.
• Participate in Group ESG meetings and initiatives.
• Coordinate the collection of ESG data and contribute to Group ESG reporting.
• Support carbon-footprint calculations and related reporting activities.
• Roll out ESG initiatives locally in coordination with Group stakeholders.

Regulatory Liaison and Governance

• Act as the primary point of contact for outsourcing-related matters with the CSSF.
• Maintain alignment with applicable regulatory requirements and guidelines, including EBA outsourcing guidance, CSSF outsourcing requirements and DORA.
• Ensure that required notifications, registrations and regulatory evidence are completed on time.
• Maintain accurate outsourcing, third-party risk, ICT provider and related governance registers.
• Ensure appropriate evidence of management and Board involvement is maintained.
• Prepare reports, presentations and documentation for senior management and the Board.

Training and Change Management

• Promote awareness of outsourcing, third-party risk, operational resilience and regulatory requirements across the organisation.
• Support the implementation of changes to policies, procedures, systems and governance arrangements.
• Attend compulsory internal training and relevant external courses as requested by the Bank.

CANDIDATE PROFILE

Education and Experience

• Bachelor’s degree in Finance, Economics, Information Technology, Law or a related discipline.
• 5–10 years of relevant experience in the financial sector, preferably in outsourcing oversight, third-party risk management, operational resilience, procurement or project coordination.
• Practical experience with DORA and CSSF outsourcing requirements, including CSSF Circular 22/806 and CSSF Circular 25/883.
• Experience managing outsourced IT, ICT or business-process services.
• Good understanding of IT services, technologies, cloud environments and associated risks.
• Experience working with service providers, contracts, SLAs, due diligence processes and remediation plans.
• Experience coordinating regulatory, risk, audit or Board-related deliverables is an advantage.
• Knowledge of ESG reporting and sustainability initiatives is an advantage.

Technical and Professional Skills

• Strong understanding of outsourcing governance and third-party risk management.
• Ability to assess operational, ICT, contractual, financial, legal and geopolitical risks.
• Good understanding of business continuity, disaster recovery and operational resilience principles.
• Strong analytical, organisational and project-management skills.
• Ability to manage multiple priorities and deliver high-quality work under time pressure.
• Excellent attention to detail and ability to maintain accurate records and governance documentation.
• Strong communication, negotiation and stakeholder-management skills.
• Ability to challenge existing processes constructively and identify practical improvements.
• High level of discretion and ability to handle confidential information.
• Proactive, pragmatic and results-oriented approach.
• Strong IT literacy.

Languages

• Fluent written and spoken English and French.
• Additional languages are considered an advantage.

Soft Competencies

We are looking for someone who demonstrates:

• Open-mindedness and team orientation: listens to others, communicates transparently and expresses views constructively.
• Innovation and continuous development: identifies improvements, embraces change and remains committed to learning.
• Professional business culture: remains composed under pressure, acts decisively and focuses on outcomes.
• Quality and regulatory awareness: maintains high standards and actively promotes compliance and best practice.
• Customer and stakeholder focus: gives priority to business needs while maintaining appropriate risk and control standards.
• Problem-solving and analytical thinking: assesses complex issues and develops practical, well-reasoned solutions.
• Organisation and accountability: manages priorities effectively and follows actions through to completion.

Union Bancaire Privée (UBP) is a family-owned company, driven by an entrepreneurial vision, innovation and independence. UBP is one of the most strongly-capitalised private banks.

By joining Union Bancaire Privée (Europe) S.A. you will embrace a team of supportive high qualified professionals in Private Banking that will lead you to develop your career to the top level. We encourage continuous learning, development and knowledge sharing. We foster a culture of Agility, Conviction, Dedication and high degree of Responsibility.

Union Bancaire Privée (Europe) S.A. encourages all suitable qualified and eligible candidates to apply regardless of their gender identity or expression, age, racial, ethnic and cultural background, religion and beliefs, sexual orientation, disability or neurodiversity.

In accordance with the provisions of the Luxembourg law of 23 July 2016 amending the law of 29 March 2013, retained candidate will be required to provide an extract from their criminal record as a part of UBP screening process.