Head of Third-Party Management, SVP

State Street is transforming how it manages third parties across the enterprise. Third-party relationships present a rapidly evolving risk profile, requiring an integrated approach to how the firm identifies, assesses, monitors, reports and manages both the relationships and the risks created by reliance on external and intragroup providers. Reporting to the enterprise Chief Operating Officer and serving on the COO Leadership Team, the Head of Third-Party Management will work closely with the Chief Risk Officer, Chief Financial Officer and Procurement, Chief Commercial Officer, and Chief Administrative Officer, including the Head of Enterprise Resiliency. This executive will establish and lead program-based processes that manage third-party relationships against both commercial and risk objectives. The organization will serve as the operational engine of the enterprise third-party management program, with accountability for:

• Intake and quality control

• Coordination with risk-domain subject-matter experts

• Due diligence

• Analytics and reporting

• Third-party inventory and data quality

• Training and change management The role will build on existing capabilities to create a best-in-class third-party management practice. A central part of the mandate is assessing third-party risk against a shifting geopolitical and technology landscape and moving the firm’s most critical vendors toward more disciplined, accountable business-as-usual engagement.

• Integrate and communicate the firm’s material third-party risks to senior management and governance forums

• Represent the program with regulators

• Serve as a trusted advisor and change agent for executive risk decisions

Why This Role Is Important State Street is a global systemically important bank with more than $57 trillion in assets under custody and/or administration and $6.3 trillion in assets under management. Its investment servicing business supports some of the world’s most sophisticated institutional investors, underpinned by the integrated front-to-back State Street Alpha platform. The firm relies on external and intragroup providers for technology, data, infrastructure, operations and client services. This reliance creates interconnected resiliency, privacy, cybersecurity, concentration and fourth-party risks across businesses, legal entities and Critical Business Services. Rapid technology change, frontier AI, data sovereignty and geopolitical instability are reshaping that risk profile. This leader will ensure that the firm’s risk identification, monitoring and engagement models remain fit for purpose, enabling State Street to use third parties safely to achieve strategic objectives while protecting clients, operations and regulatory standing.

Key Objectives and Responsibilities

1. Align third parties to business strategy Ensure third-party relationships support enterprise priorities, client needs, growth plans and operating model decisions.

2. Reaffirm and strengthen the enterprise oversight model Build on existing program foundations to maintain an enterprise oversight framework that addresses resiliency, privacy and cybersecurity in alignment with strategy, regulation and policy. Serve as principal advisor on material third-party exposures and the management actions they require. Ensure third parties supporting Critical Business Services:

• Protect client assets and support the firm’s obligations.
• Maintain tested contingency and exit strategies informed by credible disruption scenarios.
• Operate effective controls over confidential data, technology and systems.

1. Provide enterprise visibility into critical third parties and dependencies Establish enterprise agreement on the definition of a critical third party and maintain a complete, integrated view of material dependencies.

• Maintain an integrated view of third parties supporting Critical Business Services using TPRM, resiliency, cyber, privacy and legal-entity records.
• Aggregate exposure, including fourth-party risk, across engagements, legal entities and services.
• Identify concentrations, single points of failure and substitutability constraints requiring management attention, including providers whose disruption could affect multiple businesses or legal entities.

1. Manage risk across the full third-party lifecycle Evaluate inherent risks associated with outsourcing, technology providers, cloud services, data processors, sub-custodians and other critical suppliers before contracts are executed. Partner with Procurement, Legal and other functions to strengthen frameworks, processes and controls while improving onboarding cycle times. Establish rigorous standards for:

• Pre-engagement planning.
• Due diligence covering operational capacity, cybersecurity and information security, resilience, financial condition, and the third party’s own risk management and internal controls.
• Contracting.
• Ongoing monitoring of service quality, service-level agreements, findings, financial health, emerging risks and control effectiveness.
• Exit and termination planning.

1. Meet regulatory obligations Demonstrate compliance with global supervisory expectations related to outsourcing, concentration risk, data protection, operational resilience and third-party risk management. Represent the program in regulatory examinations and supervisory engagements.

2. Strengthen governance, escalation and remediation Establish clear enterprise governance for third-party risk and performance.

• Define ownership, accountability, oversight, escalation pathways, committees, risk-acceptance processes, and reporting to senior management and the Board.
• Set clear thresholds for escalating material exposures, control weaknesses, noncompliance and material remediation programs. Support executive, Board, legal-entity and regulatory reporting in partnership with businesses and functions.
• Align the program with enterprise risk appetite in partnership with Enterprise Risk Management.
• Ensure material issues have accountable owners, appropriate interim protections and tracked remediation through closure.

1. Drive strategic management of the most critical third parties Implement a disciplined, accountable business-as-usual engagement model for the firm’s most critical vendors through business owners and executive sponsors. This includes regular performance and risk reviews, executive-level relationship governance, and scenario planning for geopolitical, technology and AI-driven change.

What Success Looks Like Leadership can confidently answer five questions: Are we using third parties in a way that supports our strategy? Do we understand and control the risks they introduce? Can critical services continue if a provider fails? Are we meeting our regulatory and fiduciary obligations? Do we have sufficient governance, monitoring and exit capabilities?

Leadership Capabilities Technical Depth Significant experience building and operating best-in-class operational risk methodologies, analytics, systems and policies. Demonstrated executive leadership across risk management, analysis, governance and reporting. Collaboration and Influence Executive presence, judgment and interpersonal effectiveness to partner with senior leaders across Procurement, Legal, Compliance, Enterprise Risk Management, Technology, Operations and the businesses. Ability to respect distinct mandates while building alignment and driving enterprise decisions. Results Orientation A sustained record of improving frameworks, procedures, systems or organizations. Demonstrated ability to solve complex problems, exercise sound judgment and deliver measurable improvements in risk infrastructure and management processes. Team Leadership Proven ability to lead and develop a significant, business-focused risk management organization. Leads by example through technical credibility, engagement and accountability, with demonstrated success recruiting, motivating, managing and developing high-performing teams. Strategic Thinking As a member of the COO Leadership Team, brings a forward-looking, enterprise-wide perspective on third-party risks, relationship effectiveness and emerging dependencies to inform business and operating model decisions. Change Leadership Demonstrated success transforming and aligning organizations through people, process and technology. Comfortable challenging the status quo, articulating what must change and why, and mobilizing stakeholders through evidence-based persuasion. Able to synthesize complex matters for executive governance and Board-level committee discussions.

Third-Party Management Organization and Operating Model Business owners remain accountable for the third-party relationship. The Head of Third-Party Management owns the enterprise framework, risk assessments, governance, oversight, reporting and challenge. This operating model is consistent with the existing TPRM framework, under which engagement managers and executive sponsors own relationships while the TPRM function provides centralized oversight and lifecycle governance.

Qualifications

• 15+ years of experience in risk management, third-party risk, operational resilience or a related field within a large global financial institution, including senior leadership of enterprise programs.
• Deep knowledge of global third-party and resilience requirements, including the U.S. Interagency Guidance on Third-Party Relationships, EU Digital Operational Resilience Act (DORA), UK Prudential Regulation Authority outsourcing and operational resilience requirements, and European Banking Authority outsourcing guidelines.
• Experience engaging directly with regulators and presenting to Board-level committees.
• Strong understanding of cybersecurity, cloud, data and AI-related vendor risk.
• Bachelor’s degree required; advanced degree or relevant certifications, such as CTPRP, FRM or CISA, preferred.

Salary Range: $225,000 - $337,500 Annual The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.

Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax advantaged savings plans. For a full overview, visit https://hrportal.ehr.com/statestreet/Home.

About State Street

Across the globe, institutional investors rely on us to help them manage risk, respond to challenges, and drive performance and profitability. We keep our clients at the heart of everything we do, and smart, engaged employees are essential to our continued success.

We are committed to fostering an environment where every employee feels valued and empowered to reach their full potential. As an essential partner in our shared success, you’ll benefit from inclusive development opportunities, flexible work-life support, paid volunteer days, and vibrant employee networks that keep you connected to what matters most. Join us in shaping the future.

As an Equal Opportunity Employer, we consider all qualified applicants for all positions without regard to race, creed, color, religion, national origin, ancestry, ethnicity, age, disability, genetic information, sex, sexual orientation, gender identity or expression, citizenship, marital status, domestic partnership or civil union status, familial status, military and veteran status, and other characteristics protected by applicable law.

Discover more information on jobs at StateStreet.com/careers

Read our CEO Statement

Job Application Disclosure: It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.