Tech Risk - Third Party Lead

The Tech Risk - Third Party Lead at JP Morgan Chase within Cybersecurity and Tech Controls, leads oversight and continuous improvement within third‑party cyber assessment capability and broader third‑party assurance program. You'll define and execute the third‑party assurance strategy and help shape the operating model, priorities, and roadmap, translating strategy into scalable processes, clear governance, and measurable outcomes. You will focus on meeting executive stakeholder expectations through high‑quality reporting, metrics, and risk insights; identifies themes and emerging risks; and drives remediation, policy/standard alignment, and process enhancements to strengthen end‑to‑end third‑party risk management practices. . You will play a crucial role in fostering a robust risk culture and catalyzing continuous improvement, contributing to the development and implementation of comprehensive risk management policies, standards, and controls.

Job Responsibilities

• Lead efforts to strengthen the firm’s third-party risk assessment and control environment, identifying areas for improvement and advising on control implementation to mitigate thematic risks.
• Influence, drive, and oversee the efficient execution of third party assurance programs, ensuring alignment with organizational objectives, risk appetite, and regulatory compliance, while continuously updating requirements to address evolving threats and regulatory changes.
• Prepare and deliver reports and metrics to provide insights into risk trends and program effectiveness, engaging with stakeholders to communicate the status of third-party cyber and technology risks.
• Collaborate with Control Owners to establish and uphold clear cyber, technology, and data control requirements for all third-party relationships.
• Act as a liaison to Global Supplier Services, Tech Risk and Controls, Product Security, Business Control Managers, and GRC leads to foster a collaborative approach to third-party risk management.
• Uses enterprise-authorized AI capabilities within the work environment to accelerate synthesis of risk/control evidence and draft executive-ready reporting, validating outputs and handling data according to sensitivity and security requirements
• Promotes reuse-first, AI-assisted approaches to streamline recurring control testing and issue/action-plan management routines, ensuring human review and alignment to auditability and regulatory expectations
• Stay abreast of industry developments, emerging threats, and best practices to ensure the program remains cutting-edge.

Required qualifications, capabilities, and skills

• Obtain 5 plus years of experience in third-party risk management, cybersecurity, technology risk, or related disciplines and/or Bachelor’s degree in Information Security, Cybersecurity, Risk Management, Business Administration, or related field; Master’s degree a plus
• Experience in a highly regulated industry (e.g., financial services, healthcare) is strongly preferred.
• Proven ability to lead cross-functional teams, influence senior stakeholders, and drive strategic initiatives.
• Deep understanding of third-party risk management frameworks, cybersecurity controls, and regulatory requirements (e.g., OCC, FFIEC, GDPR, ISO 27001, NIST), experience utilizing a range of GRC (Governance, Risk, and Compliance) and data analytics platforms, such as Archer, ServiceNow, Alteryx, Tableau, and QlikView.
• Demonstrated experience using enterprise-authorized AI capabilities within the work environment to support technology risk and controls workflows with strong validation habits and awareness of data sensitivity.
• Ability to review and validate AI-assisted risk summaries and recommendations before use, escalating when uncertain and ensuring outcomes align to security, auditability, and regulatory expectations.
• Strong analytical skills with experience developing and presenting risk metrics, dashboards, and executive-level reports.
• Experience working with legal and procurement teams to negotiate and strengthen contractual provisions related to cybersecurity and data protection.
• Excellent interpersonal and communication skills, with the ability to build relationships and collaborate across business units and technical teams.
• Demonstrated ability to manage complex programs and projects, prioritize competing demands, and deliver results in a fast-paced environment.
• Commitment to continuous improvement, staying current with industry trends, emerging threats, and best practices.

Preferred qualifications, capabilities, and skills

• Certified Third Party Risk Professional (CTPRP), Certified Regulatory Vendor Program Manager (CRVPM), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC)
• Perform as a Strategic thinker with a hands-on approach
• Ability to work independently and as part of a team
• Adaptability to changing regulatory and business environments

#CTC

About Us

JPMorganChase, one of the oldest financial institutions, offers innovative financial solutions to millions of consumers, small businesses and many of the world’s most prominent corporate, institutional and government clients under the J.P. Morgan and Chase brands. Our history spans over 200 years and today we are a leader in investment banking, consumer and small business banking, commercial banking, financial transaction processing and asset management.

We offer a competitive total rewards package including base salary determined based on the role, experience, skill set and location. Those in eligible roles may receive commission-based pay and/or discretionary incentive compensation, paid in the form of cash and/or forfeitable equity, awarded in recognition of individual achievements and contributions. We also offer a range of benefits and programs to meet employee needs, based on eligibility. These benefits include comprehensive health care coverage, on-site health and wellness centers, a retirement savings plan, backup childcare, tuition reimbursement, mental health support, financial coaching and more. Additional details about total compensation and benefits will be provided during the hiring process.

We recognize that our people are our strength and the diverse talents they bring to our global workforce are directly linked to our success. We are an equal opportunity employer and place a high value on diversity and inclusion at our company. We do not discriminate on the basis of any protected attribute, including race, religion, color, national origin, gender, sexual orientation, gender identity, gender expression, age, marital or veteran status, pregnancy or disability, or any other basis protected under applicable law. We also make reasonable accommodations for applicants’ and employees’ religious practices and beliefs, as well as mental health or physical disability needs. Visit our FAQs for more information about requesting an accommodation.

JPMorgan Chase & Co. is an Equal Opportunity Employer, including Disability/Veterans

About the TeamOur professionals in our Corporate Functions cover a diverse range of areas from finance and risk to human resources and marketing. Our corporate teams are an essential part of our company, ensuring that we’re setting our businesses, clients, customers and employees up for success.