IT Third-Party Controls Analyst

Guild Mortgage Company, closing loans and opening doors since 1960. As a mortgage banking firm we are dedicated to serving the home owner/buyer. Our goal is to provide affordable home financing for our customers, utilizing the best terms available while providing a level of professionalism and service unsurpassed in the lending industry.

Position Summary

The IT Third-Party Controls Analyst supports the governance, monitoring, and control of Guild's third-party relationships and external business partner access throughout the engagement lifecycle. This includes offshore staffing, SaaS/cloud providers, outsourced service providers, contractors, and non-standard access models where external users may receive elevated or internal-like access to Guild systems.

Under general supervision, the role executes and monitors IT General Controls that reduce third-party and external-user risk, including due diligence support, engagement classification, access and identity oversight, provisioning and deprovisioning controls, data protection, incident response, governance reporting, and remediation tracking. The role partners with IT Governance, Information Security, IT Operations, IAM, Vendor Management, HR, Legal/Compliance, and other stakeholders to ensure access models, least-privilege controls, certifications, monitoring expectations, and onboarding/offboarding processes are appropriately defined, documented, and maintained.

Compensation 

This role is an exempt position with a Targeted Salary Range of $82,506 to $118,344.94 annually.

Compensation at Guild is influenced by a wide array of factors including but not limited to local and federal minimum wage requirements, education, level of experience, and applicant’s geographical location.

Essential Functions

• Serve as the IT General Controls contact for third-party technology relationships, including offshore staffing, SaaS/cloud providers, outsourced services, contractors, and staff augmentation. 

• Document third-party due diligence and approval updates and partner with IT and Compliance to keep third-party records current. 
• Translate completed due diligence and risk assessment findings into operational control requirements, ensuring identified risks are addressed through appropriately designed controls prior to go-live. 
• Own third-party engagement classification and setup, ensuring new offshore roles, contractor engagements, and outsourced arrangements are properly configured before onboarding. 
• Review third-party roles and access to confirm they match job function and least-privilege requirements. 
• Support governance and control oversight for external business partner users with elevated or internal-like access to Guild systems, including validation that access models, approved roles, identity attributes, and monitoring requirements are clearly defined and documented. 
• Coordinate periodic access certifications for third-party and external business partner users, confirming continued business need, appropriate branch/location segmentation, least-privilege alignment, and timely removal or adjustment of access no longer required. 
• Monitor virtual desktop and third-party access controls to ensure control effectiveness. 
• Track MFA enrollment and re-enrollment controls for third-party users, escalating gaps to IT Operations and Information Security as needed. 
• Oversee controls for external business partner users with elevated or internal-like access, including access models, approved roles, identity attributes, and monitoring requirements. 
• Coordinate access certifications for third-party and external business partner users, confirming business needs, segmentation, least privilege, and timely access removal or adjustment. 
• Track remediation for non-standard external access risks, including identity gaps, manual provisioning, over-provisioning, incomplete deprovisioning, and missing enhanced monitoring. 
• Work with IT and business stakeholders to confirm third-party access, identity, and provisioning controls remain properly scoped throughout the relationship. 
• Monitor IT General Controls across the third-party lifecycle to confirm vendors, offshore resources, and contractors remain within approved control parameters. 
• Monitor DLP controls for third-party relationships, including VDI, no-print, no-download, record retention, and data-handling requirements, with IT Governance and Information Security. 
• Monitor endpoint protection and CASB/Zscaler controls for third-party and offshore endpoints to confirm compliance with security policies. 
• Coordinate White Room setup and control validation for high-risk third-party engagements requiring enhanced physical or logical security. 
• Manage third-party role and scope changes, ensuring changes are documented, approved, and communicated to affected teams. 
• Track control issues, gaps, and remediation activities from monitoring, incidents, or audits. Maintain accurate documentation and coordinate with the IT Third-Party Risk Analyst to align remediation plans. 
• Plan and facilitate third-party incident tabletop exercises, documenting execution and results. 
• Own third-party incident escalation and reporting activities, ensuring incidents are logged, escalated, and tracked to resolution. 
• Prepare periodic third-party risk reporting for oversight and Governance Committees, including control performance, open issues, remediation status, evidence, metrics, and KRI support. 
• Support third-party Business Continuity Planning (BCP) and Disaster Recovery (DR) planning and annual testing activities. 
• Support internal and external audits and regulatory examinations related to third-party IT General Controls by providing control documentation, evidence, and walkthrough support. 
• Monitor third-party offboarding and exit controls, confirming timely removal of system and physical access and closure of contractual and data obligations when engagements end or change. 
• Track and support remediation of control gaps related to non-standard external access models, including inconsistent identity domains, manual provisioning processes, over-provisioned access, incomplete deprovisioning, or insufficient enhanced monitoring. 
• Support third-party oversight, governance activities, risk classification, location reviews, contract management, and engagement intake. 
• Maintain the third-party control library, including process flows, procedure documentation, and control narratives, in coordination with the broader IT team and the IT Third-Party Risk Analyst. 
• Produce deliverables including process flows, procedure documentation, and specialized assessment reports related to third-party processes, tools, metrics, and communication activities. 
• Serve as an advisor to the IT General Controls Manager on third-party control matters and act as a liaison between IT Governance, Vendor Management, Corporate Initiatives, IT Operations, Information Security, HR, Legal, Compliance, and other stakeholders. 
• Assist in maintaining Guild's compliance with applicable regulatory requirements as they relate to third-party staffing, sourcing, and operations. 
• Champion awareness and understanding of third-party control requirements through training, presentations, and regular communication. 
• Drive a culture of continuous improvement and customer service excellence, with visible metrics and KPIs specific to third-party control performance. 
• Monitor industry best practices related to third-party control frameworks and recommend enhancements to the IT General Controls Manager. 
• Perform other duties as assigned. 

Qualifications

Supervision

• Job Scope: Plays a key role in area by generating insights and ideas on policies, processes, procedures, and efficiency; contributes ideas to strategic and operational plans to ensure alignment

• Complexity: Problem solving involves evaluating and resolving discrepancies with people, data, analyses, processes, etc. within prescribed program/project guidelines; may also involve resolving basic resource coordination and availability

• Impact: Decisions and actions have an impact on the smooth operation and timeframes of the department, programs/projects; impact on the broader organization is generally indirect

• Interaction/Supervision: Works under broad direction with considerable latitude for independent actions; guided by professional standards, desired outcomes and unit/project/program specifications

Requirements

Physical: Work is primarily sedentary; mobility in an office setting.

Manual Dexterity: Ability to operate standard office equipment and keyboards.

Audio/Visual: Regularly required to accurately perceive, distinguish and interpret information received visually and through audio; e.g., words, numbers and other data broadcasted aloud/viewed on a screen, as well as print and other media.

Environmental: Office environment – moderate noise, no substantial exposure to adverse environmental conditions.

Travel: 5% or less

Mental: Learn new tasks, remember processes, maintain focus, complete tasks independently, and make timely decisions in the context of a workflow.

Schedules: Work is primarily performed during the business week, Monday - Friday

Guild offers a pleasant work environment, competitive compensation and excellent benefits package; including medical, dental, vision, life insurance, AD&D, LTD and 401(k) with employer match.

Guild Mortgage Company is an Equal Opportunity Employer. 

 REQ#: ITTHI018470