Manager - Vendor Governance Management (Risk)

The Manager, Vendor Governance Management (Risk) leads a team responsible for consistent, timely, and risk-based execution of the vendor governance lifecycle. The role translates policy and regulatory requirements into effective operational controls across intake, inherent risk stratification, due diligence, ongoing monitoring, renewal and reassessment, issue remediation, and closure. units.

Role Responsibilities

1. Risk Governance and Assessment Oversight

·       Own the day-to-day governance and delivery of vendor risk assessments, including inherent risk screening, due diligence, reassessments, renewals, material changes, and event-driven reviews.

·       Ensure assessments are risk-based, evidence-supported, complete, and aligned with applicable outsourcing and third-party risk policies, standards, procedures, and jurisdictional requirements.

·       Provide independent review and challenge on risk ratings, control gaps, residual risk, compensating controls, and proposed risk acceptance or treatment decisions.

·       Coordinate with Privacy, Information Security, Business Continuity, Compliance, Legal, Sourcing, Procurement, and business owners to obtain timely specialist input and resolve complex cases.

·       Escalate material risks, policy exceptions, overdue actions, control failures, and unresolved ownership issues through the appropriate governance channels.

2. Corrective Action, Incident, and Emerging Risk Management

·       Lead governance of corrective action plans, including clear ownership, achievable target dates, evidence standards, aging controls, escalation thresholds, and closure validation.

·       Oversee third-party risk incidents and emerging-risk monitoring, ensuring impact assessment, stakeholder notification, root-cause analysis, remediation, and follow-through.

·       Use external risk intelligence and internal data to identify financial, cyber, operational, reputational, concentration, geographic, and business-continuity concerns that require action.

·       Ensure highest-risk and critical vendors receive appropriate monitoring intensity, contingency planning, exit considerations, and senior-management visibility.

3. Operational Performance, Data Quality, and Reporting

·       Manage team capacity, work allocation, priorities, and service levels across markets, segments, and assessment types, balancing urgency, risk, and customer impact.

·       Maintain reliable management information covering assessment volumes, turnaround time, aging, backlog, overdue corrective actions, risk distribution, quality results, and recurring control themes.

·       Validate the accuracy, completeness, and traceability of vendor risk data and supporting evidence in the systems of record before reporting or governance submission.

·       Prepare concise executive insights and path-to-green actions for monthly operating reviews, quarterly business reviews, risk forums, audits, and regulatory inquiries.

·       Drive process standardization, automation, and continuous improvement across intake, assessment, quality assurance, tracking, communications, and reporting.

4. Stakeholder and Regulatory Partnership

·       Act as the operational subject-matter expert for vendor risk governance and clearly communicate requirements, decisions, dependencies, and consequences to business and functional stakeholders.

·       Partner with Procurement and Sourcing so risk results inform vendor selection, contracting strategy, protective clauses, renewals, remediation commitments, and exit decisions.

·       Support audits, regulatory reviews, internal control testing, and management attestations with complete, accurate, and timely evidence.

·       Build trusted relationships with onshore partners, market stakeholders, vendor owners, and risk subject-matter experts while maintaining appropriate independence and constructive challenge.

5. People Leadership and Capability Building

·       Set clear performance expectations and measurable goals for analysts and specialists, including productivity, quality, timeliness, risk judgment, documentation, and stakeholder management.

·       Coach team members through regular one-on-ones, case reviews, calibration sessions, quality feedback, and individual development plans.

·       Build cross-training, succession, and backup coverage to reduce key-person dependency and maintain continuity during peaks, transitions, and absences.

·       Create an accountable and inclusive team culture that encourages early escalation, continuous learning, collaboration, and ownership of outcomes.

·       Identify skills gaps and deliver targeted learning on policy, regulatory expectations, risk domains, systems, data analysis, executive communication, and decision quality.

Qualifications and Experience

·       Undergraduate degree in business, risk management, finance, procurement, information systems, or a related discipline; relevant postgraduate study is an advantage.

·       Typically 8 or more years of progressive experience in third-party risk, vendor governance, operational risk, procurement, compliance, outsourcing governance, or a related field, including demonstrated people or team leadership.

·       Experience managing risk assessments and remediation across multiple business units, markets, or jurisdictions in a regulated and globally distributed environment.

·       Working knowledge of third-party risk domains, including cybersecurity, privacy, business continuity, financial viability, compliance, reputational risk, concentration risk, and subcontractor or fourth-party risk.

·       Experience with workflow and reporting tools such as Microsoft Excel, Power BI, Power Automate, SharePoint, and enterprise governance, risk, procurement, or vendor-management platforms.

·       Relevant credentials such as CTPRP, CRVPM, CERP, CISA, CRISC, CISM, CGRC, or procurement and operational-risk certifications are advantageous but not mandatory.

Leadership Competencies

·       Risk-based judgment: distinguishes material risk from process noise and makes timely, defensible decisions.

·       Execution discipline: converts requirements into clear ownership, milestones, controls, and measurable outcomes.

·       Constructive challenge: influences stakeholders confidently while preserving partnership and independence.

·       Executive communication: simplifies complex risk information into concise implications, options, and recommendations.

·       People development: raises team capability through coaching, calibration, feedback, empowerment, and succession planning.

·       Transformation mindset: uses data, standardization, automation, and root-cause analysis to improve control effectiveness and customer experience.

·       Integrity and accountability: owns outcomes, escalates transparently, protects confidential information, and models sound risk behavior.

When you join our team:

• We’ll empower you to learn and grow the career you want.
• We’ll recognize and support you in a flexible environment where well-being and inclusion are more than just words.
• As part of our global team, we’ll support you in shaping the future you want to see

About Manulife and John Hancock

Manulife Financial Corporation is a leading international financial services provider, helping people make their decisions easier and lives better. To learn more about us, visit https://www.manulife.com/en/about/our-story.html.

Manulife is an Equal Opportunity Employer

At Manulife/John Hancock, we embrace our diversity. We strive to attract, develop and retain a workforce that is as diverse as the customers we serve and to foster an inclusive work environment that embraces the strength of cultures and individuals. We are committed to fair recruitment, retention, advancement and compensation, and we administer all of our practices and programs without discrimination on the basis of race, ancestry, place of origin, colour, ethnic origin, citizenship, religion or religious beliefs, creed, sex (including pregnancy and pregnancy-related conditions), sexual orientation, genetic characteristics, veteran status, gender identity, gender expression, age, marital status, family status, disability, or any other ground protected by applicable law.

It is our priority to remove barriers to provide equal access to employment. A Human Resources representative will work with applicants who request a reasonable accommodation during the application process. All information shared during the accommodation request process will be stored and used in a manner that is consistent with applicable laws and Manulife/John Hancock policies. To request a reasonable accommodation in the application process, contact hr@manulife.com.