Head of Third-Party Management, SVP

State Street is transforming how it manages third parties across the enterprise. Third-party relationships present a rapidly evolving risk profile, requiring an integrated approach to how the firm identifies, assesses, monitors, reports and manages both the relationships and the risks created by reliance on external and intragroup providers.

Reporting to the enterprise Chief Operating Officer and serving on the COO Leadership Team, the Head of Third-Party Management will work closely with the Chief Risk Officer, Chief Financial Officer and Procurement, Chief Commercial Officer, and Chief Administrative Officer, including the Head of Enterprise Resiliency.

This executive will establish and lead program-based processes that manage third-party relationships against both commercial and risk objectives. The organization will serve as the operational engine of the enterprise third-party management program, with accountability for:

· Intake and quality control

· Coordination with risk-domain subject-matter experts

· Due diligence

· Analytics and reporting

· Third-party inventory and data quality

· Training and change management

The role will build on existing capabilities to create a best-in-class third-party management practice. A central part of the mandate is assessing third-party risk against a shifting geopolitical and technology landscape and moving the firm’s most critical vendors toward more disciplined, accountable business-as-usual engagement.

· Integrate and communicate the firm’s material third-party risks to senior management and governance forums

· Represent the program with regulators

· Serve as a trusted advisor and change agent for executive risk decisions

Why This Role Is Important

State Street is a global systemically important bank with more than $57 trillion in assets under custody and/or administration and $6.3 trillion in assets under management. Its investment servicing business supports some of the world’s most sophisticated institutional investors, underpinned by the integrated front-to-back State Street Alpha platform.

The firm relies on external and intragroup providers for technology, data, infrastructure, operations and client services. This reliance creates interconnected resiliency, privacy, cybersecurity, concentration and fourth-party risks across businesses, legal entities and Critical Business Services.

Rapid technology change, frontier AI, data sovereignty and geopolitical instability are reshaping that risk profile. This leader will ensure that the firm’s risk identification, monitoring and engagement models remain fit for purpose, enabling State Street to use third parties safely to achieve strategic objectives while protecting clients, operations and regulatory standing.

Key Objectives and Responsibilities

1. Align third parties to business strategy

Ensure third-party relationships support enterprise priorities, client needs, growth plans and operating model decisions.

2. Reaffirm and strengthen the enterprise oversight model

Build on existing program foundations to maintain an enterprise oversight framework that addresses resiliency, privacy and cybersecurity in alignment with strategy, regulation and policy. Serve as principal advisor on material third-party exposures and the management actions they require. Ensure third parties supporting Critical Business Services:

· Protect client assets and support the firm’s obligations.

· Maintain tested contingency and exit strategies informed by credible disruption scenarios.

· Operate effective controls over confidential data, technology and systems.

3. Provide enterprise visibility into critical third parties and dependencies

Establish enterprise agreement on the definition of a critical third party and maintain a complete, integrated view of material dependencies.

· Maintain an integrated view of third parties supporting Critical Business Services using TPRM, resiliency, cyber, privacy and legal-entity records.

· Aggregate exposure, including fourth-party risk, across engagements, legal entities and services.

· Identify concentrations, single points of failure and substitutability constraints requiring management attention, including providers whose disruption could affect multiple businesses or legal entities.

4. Manage risk across the full third-party lifecycle

Evaluate inherent risks associated with outsourcing, technology providers, cloud services, data processors, sub-custodians and other critical suppliers before contracts are executed. Partner with Procurement, Legal and other functions to strengthen frameworks, processes and controls while improving onboarding cycle times. Establish rigorous standards for:

· Pre-engagement planning.

· Due diligence covering operational capacity, cybersecurity and information security, resilience, financial condition, and the third party’s own risk management and internal controls.

· Contracting.

· Ongoing monitoring of service quality, service-level agreements, findings, financial health, emerging risks and control effectiveness.

· Exit and termination planning.

5. Meet regulatory obligations

Demonstrate compliance with global supervisory expectations related to outsourcing, concentration risk, data protection, operational resilience and third-party risk management. Represent the program in regulatory examinations and supervisory engagements.

6. Strengthen governance, escalation and remediation

Establish clear enterprise governance for third-party risk and performance.

· Define ownership, accountability, oversight, escalation pathways, committees, risk-acceptance processes, and reporting to senior management and the Board.

· Set clear thresholds for escalating material exposures, control weaknesses, noncompliance and material remediation programs. Support executive, Board, legal-entity and regulatory reporting in partnership with businesses and functions.

· Align the program with enterprise risk appetite in partnership with Enterprise Risk Management.

· Ensure material issues have accountable owners, appropriate interim protections and tracked remediation through closure.

7. Drive strategic management of the most critical third parties

Implement a disciplined, accountable business-as-usual engagement model for the firm’s most critical vendors through business owners and executive sponsors. This includes regular performance and risk reviews, executive-level relationship governance, and scenario planning for geopolitical, technology and AI-driven change.

What Success Looks Like

Leadership can confidently answer five questions:

Are we using third parties in a way that supports our strategy?

Do we understand and control the risks they introduce?

Can critical services continue if a provider fails?

Are we meeting our regulatory and fiduciary obligations?

Do we have sufficient governance, monitoring and exit capabilities?

Leadership Capabilities

Technical Depth

Significant experience building and operating best-in-class operational risk methodologies, analytics, systems and policies. Demonstrated executive leadership across risk management, analysis, governance and reporting.

Collaboration and Influence

Executive presence, judgment and interpersonal effectiveness to partner with senior leaders across Procurement, Legal, Compliance, Enterprise Risk Management, Technology, Operations and the businesses. Ability to respect distinct mandates while building alignment and driving enterprise decisions.

Results Orientation

A sustained record of improving frameworks, procedures, systems or organizations. Demonstrated ability to solve complex problems, exercise sound judgment and deliver measurable improvements in risk infrastructure and management processes.

Team Leadership

Proven ability to lead and develop a significant, business-focused risk management organization. Leads by example through technical credibility, engagement and accountability, with demonstrated success recruiting,