Manager, Third Party Risk Management

The Team: 

Upstart’s Risk team is building its second line of defense function in support of its application to establish Upstart Bank, N.A., a de novo national bank. The team is responsible for Upstart’s enterprise risk management program and risk governance, providing independent oversight and credible challenge across key risk categories including operational risk, third-party risk, technology and information security risk, treasury risk, and compliance risk. The Risk team partners closely with business leaders, executive management, and the Board to ensure material risks are effectively identified, assessed, monitored, and governed in alignment with OCC, FDIC, and interagency regulatory expectations.

As the Manager, Third Party Risk Management at Upstart, you will lead the day-to-day execution of the bank’s third-party risk management program and oversee a team responsible for risk assessments, due diligence, ongoing monitoring, and vendor oversight activities. You will play a key role in ensuring the program remains scalable, exam-ready, and aligned with evolving regulatory expectations while supporting the growth of Upstart Bank.

How you’ll make an impact

• Lead execution of the bank’s end-to-end third-party risk management program, including risk-tiered due diligence, onboarding risk assessments, ongoing monitoring, and offboarding activities across all vendor tiers.
• Manage and develop the Third-Party Risk Management team by setting priorities, providing coaching, and ensuring consistent, high-quality risk assessments and oversight activities.
• Serve as the primary second-line escalation point for elevated or complex third-party risk matters, providing risk-based recommendations and ensuring issues are appropriately documented, tracked, and resolved.
• Maintain and enhance third-party risk management frameworks, risk tiering methodologies, assessment templates, and governance processes to support a scalable, risk-based program.
• Partner with Legal, Compliance, Information Security, Affiliate Risk, and business stakeholders to ensure consistent application of third-party risk standards throughout the vendor lifecycle.
• Lead regulatory examination readiness and support responses to OCC, FDIC, internal audit, and external audit inquiries related to third-party risk management.

Minimum Qualifications 

• Bachelor’s degree or equivalent practical experience.
• 6+ years of experience in third-party risk management, compliance, audit, operational risk, or a related risk discipline within a banking or financial services environment.
• Experience leading a third-party risk management program, including risk assessments, due diligence reviews, ongoing monitoring, and issue management across a multi-vendor portfolio.
• Knowledge of OCC, FDIC, and interagency guidance related to third-party relationships and risk management, including the 2023 Interagency Guidance on Third-Party Relationships: Risk Management.
• Experience assessing and managing risks associated with multiple third-party relationship types, including suppliers, lending partners, affiliates, and technology service providers.

Preferred Qualifications

• Direct experience supporting OCC or FDIC regulatory examinations related to third-party risk management.
• Experience leading or developing risk, compliance, audit, or third-party risk professionals.
• Knowledge of affiliate risk oversight requirements, including Regulation W and related regulatory expectations.
• Experience operating within a fintech, digital banking, or technology-intensive environment, including oversight of cloud, SaaS, and other technology service providers.
• Experience using governance, risk, and compliance (GRC) platforms to support third-party risk assessments, issue management, workflow automation, and ongoing monitoring activities.

Position location This role is available in the following locations: Remote 

Time zone requirements The team operates on the East/West coast time zones. 

Travel requirements As a digital first company, the majority of your work can be accomplished remotely. The majority of our employees can live and work anywhere in the U.S but are encouraged to to still spend high quality time in-person collaborating via regular onsites. The in-person sessions’ cadence varies depending on the team and role; most teams meet once or twice per quarter for 2-4 consecutive days at a time.

#LI-REMOTE

#LI-MidSenior --> use for L5, L6