Vendor Risk Manager Jobs in Boston, MA (NOW HIRING)

Morgan Stanley Investment Management (MSIM) is seeking an experienced Vice President / Executive Director to lead its Third-Party Risk and Resilience function. This individual will oversee MSIM's compliance with Firm third-party risk management policies, procedures, and standards, as well as resilience obligations, while driving strong partnership and collaboration across business, technology, operations, and Firmwide stakeholder groups.

The Third-Party Risk & Resilience Lead will direct third-party risk and resilience oversight for MSIM, with particular focus on third-party services which support critical business processes, outsourcing arrangements, third-party incidents, regulatory-driven initiatives, and remediation of control gaps. The role is accountable for ensuring appropriate governance, documentation, testing, reporting, escalation, evidence, and issue closure across all third-party risk and resilience obligations.

The successful candidate will lead a team responsible for executing third-party risk program requirements and resilience obligations, delivering first-line governance across the full third-party lifecycle including risk assessment, ongoing monitoring, issue management, resilience planning, testing, governance, and reporting. Candidates should bring at least 10 years of relevant experience, with a demonstrated ability to lead a function, manage competing priorities across a team, influence within a matrixed organization, provide credible challenge, and drive execution through a practical, collaborative approach.

Key Responsibilities

Leadership & Operating Model

• Lead the MSIM Third-Party Risk and Resilience function, including management of a team responsible for governance, reporting, issue management, Contingency and Exit Plan (CP/EP) execution, testing coordination, and stakeholder engagement.
• Set priorities, allocate work, and oversee deliverables to ensure the team meets Firm requirements and MSIM business needs on time and to a consistent standard.
• Support enhancement of the MSIM third-party risk and resilience operating model, including roles and responsibilities, escalation paths, reporting standards, and evidence expectations.
• Serve as MSIM's lead point of contact for third-party risk and resilience matters, partnering closely with Service Owners, Third-Party Program Management, Operational Risk, Business Unit Risk Officers (BUROs), Legal, Compliance, and other Firm stakeholders.

Third-Party Lifecycle Governance

• Oversee governance across the full third-party risk lifecycle including service selection, due diligence, inherent risk assessment, criticality determination, ongoing monitoring, issue remediation, risk acceptance, termination, and offboarding.
• Partner with Service Owners to ensure execution of required vendor management activities, including service validations, meeting minutes, training, and ongoing monitoring.
• Review and approve new or modified service records and criticality ratings where required; support accurate maintenance of firm tooling including iShield, Third-Party Application Inventory (TAI), Service Provider Risk Level (SPRL), and related resilience data sources.

Resilience & Contingency Planning

• Own the creation, maintenance, and ongoing governance of Resilience Plans for critical or regulatory in-scope third-party services which includes Contingency Plans (CPs) for temporary provider disruptions and Exit Plans (EPs) for permanent provider transitions.
• Manage the end-to-end CP/EP lifecycle, including refreshes, approvals, evidence collection, and testing coordination, while evaluating plan quality and associated risk.
• Lead operational mapping and dependency identification across critical third-party services, documenting dependencies among business processes, applications, vendors, data flows, recovery requirements, and exit strategies.
• Lead incident preparedness for critical third-party services, including documented response actions for vendor failure scenarios and Incident Management Playbooks where no viable workaround exists.

Reporting & Escalation

• Develop senior management reporting, including metrics, dashboards, Key Risk Indicators (KRIs), issue summaries, CP/EP status, and testing outcomes; present material issues, plan gaps, and remediation status to governance committees as required.
• Track, escalate, and drive remediation of third-party issues, findings, overdue actions, and control or resilience gaps including failed or partially effective tests through closure.

Qualifications

• Minimum of 10 years of relevant experience in third-party risk management, operational resilience, operational risk, business controls, vendor management, outsourcing governance, business continuity, or a related discipline. Financial services experience required; asset management experience preferred.
• Experience leading a function, team, or cross-functional program, including setting priorities, managing deliverables, and driving accountability.
• Strong understanding of third-party risk lifecycle management, operational resilience, criticality assessment, issue management, risk acceptance, operational mapping, incident preparedness, and testing governance.
• Ability to interpret policies, procedures, standards, and expectations, and translate them into practical business requirements.
• Strong relationship management skills, with the ability to partner across business, risk, control, technology, operations, and Firmwide teams; influence without direct authority; and provide credible challenge.
• Strong analytical and written communication skills; experience supporting audit, compliance review, or management review activity preferred.
• Experience with vendor risk management tools and resilience data sources preferred, including iShield, TAI, and SPRL.

WHAT YOU CAN EXPECT FROM MORGAN STANLEY:

At Morgan Stanley, we raise, manage and allocate capital for our clients - helping them reach their goals. We do it in a way that's differentiated - and we've done that for 90 years. Our values - putting clients first, doing the right thing, leading with exceptional ideas, committing to diversity and inclusion, and giving back - aren't just beliefs, they guide the decisions we make every day to do what's best for our clients, communities and more than 80,000 employees in 1,200 offices across 42 countries. At Morgan Stanley, you'll find an opportunity to work alongside the best and the brightest, in an environment where you are supported and empowered. Our teams are relentless collaborators and creative thinkers, fueled by their diverse backgrounds and experiences. We are proud to support our employees and their families at every point along their work-life journey, offering some of the most attractive and comprehensive employee benefits and perks in the industry. There's also ample opportunity to move about the business for those who show passion and grit in their work.

To learn more about our offices across the globe, please copy and paste https://www.morganstanley.com/about-us/global-offices into your browser.

Expected base pay rates for the role will be between $150,000 and $225,000 per year at the commencement of employment. However, base pay if hired will be determined on an individualized basis and is only part of the total compensation package, which, depending on the position, may also include commission earnings, incentive compensation, discretionary bonuses, other short and long-term incentive packages, and other Morgan Stanley sponsored benefit programs.

Morgan Stanley is an equal opportunity employer committed to building and maintaining a workforce that is diverse in experience and background. Our recruiting efforts reflect our strong commitment to a culture of inclusion, where individuals are hired, developed, and advanced based on their skills and talents.

Our workforce reflects a broad cross-section of the global communities in which we operate, bringing a variety of backgrounds, talents, perspectives, and experiences.

For more information, please visit: https://www.morganstanley.com/people-opportunities/eeo.