Senior Risk Associate

• Run third party risk operations: vendor intake and tiering, due diligence and certification report review, control effectiveness ratings, the vendor risk register, annual reviews, and vendor issue and incident tracking.

• Support the enterprise risk assessment and the risk register: maintain the assessment inventory and calendar, collect and test control evidence, apply the enterprise rating methodology consistently across sub-assessments, and prepare Enterprise Risk Committee materials.

• Continuously improve the programs: refine rubrics, weights, questionnaires, and templates based on observed outcomes, and author and maintain the SOPs that make each assessment repeatable by someone other than you.

• Test, deploy, and tune agentic tooling across the assessment workflows, including document review, questionnaire analysis, vendor due diligence, and drafting, and document the context that makes the output repeatable and defensible.

• Define and report the KPIs and KRIs for the assessment programs, and surface concentration, trend, and thematic findings to leadership and oversight forums.

• Serve as the evidence owner for partner bank, audit, and examiner requests touching client, third party, and enterprise risk assessment.

• Mentor and cross-train teammates on assessment methodology, scoring discipline, and the tooling.

What you'll bring:

• Hands-on experience conducting risk assessments in fintech, payments, or banking, across client or counterparty, third party or vendor, and enterprise or operational risk.

• Working knowledge of underwriting fundamentals: financial statement review, liquidity and runway analysis, loss and exposure monitoring, and limit setting.

• Fluency with rubric-based scoring methodologies and the discipline to apply them consistently and defend a rating.

• A track record of owning discrete risk programs end to end with limited guidance, including authoring the SOPs and defining the metrics that govern them.

• Ability to read control reports (ISO 27001, SOC 2 Type II, PCI DSS AOC) and translate findings into a residual risk position and a remediation ask.

• Comfort working with AI-assisted or agentic tooling, including how to test, tune, document, and defend AI-assisted decisions to bank partners and regulators

• Self-starter who can create structure where none exists and knows when to escalate and collaborate

• Clear, concise writing under a compliance standard: assessments, memos, and committee materials that hold up in front of a partner bank or an examiner.

The annual US salary range for this role is $86,000 - $144,000, plus equity. This salary range may be inclusive of several career levels at Lithic and will be narrowed during the interview process based on the candidate’s experience and qualifications.

Benefits for Full-Time US Employees:

• Unlimited PTO

• 12-weeks fully paid parental leave

• 4-Week Fully Paid Sabbatical (earned at your 5-year anniversary)

• Work From Anywhere: work from anywhere in the world 4-weeks each year

• 3% cashback on card purchases with your complimentary Privacy.com employee account

• Health, vision, and dental insurance; HSA Contribution Match

• 401(k) match

• Voluntary Life Insurance and STD/LTD

NYC-based employees work from our SoHo office three days a week. Tuesdays and Thursdays are our core days, and you'll choose a third day that works for your schedule and team needs.

In-office employees receive:

• Commuter benefit

• Catered lunch every Tuesday and Thursday

• Risk & Compliance