IT Third-Party Controls Analyst

We need to output HTML fragment with sections: Use

for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must not repeat job title as heading. We need to include only sections with real content. The posting includes: Position Summary (we can treat as About the role). Essential Functions (Responsibilities). Qualifications (Qualifications). Also there is Compensation (Pay). Benefits: "Guild offers a pleasant work environment, competitive compensation and excellent benefits package; including medical, dental, vision, life insurance, AD&D, LTD and 401(k) with employer match." That's benefits. Schedule: "Schedules: Work is primarily performed during the business week, Monday - Friday". So schedule section. Also maybe Skills? Not explicitly separate; but we could include Skills as part of Qualifications? The instruction: Use headings only when posting has real, specific content for it. We have content for About the role (Position Summary), Responsibilities (Essential Functions), Qualifications (Qualifications), Pay (Compensation), Benefits, Schedule. We should not include Skills if not explicit. Also we need to avoid filler like "commensurate with experience". Not present. We need to preserve all substantive information, not invent or summarize away detail. Must include all details from those sections. We need to format lists with

• for any list of duties/requirements/benefits. For prose use

  . So we need to decide which parts are lists. Position Summary: It's a paragraph. We'll put in

  . Essential Functions: Many bullet-like sentences each starting with a verb. Could be turned into

  • . We'll treat each sentence as list item. Qualifications: Contains bullet-like sentences? It's a paragraph with many sentences separated by periods. Could be list but not explicit bullet. We could treat as
    • each requirement? Might be okay but risk of over-splitting. The instruction: Use
      • for any list of duties/requirements/benefits. The qualifications section is a list of requirements; we can treat each sentence as list item. However we must preserve all info; splitting into list items is fine as long as we don't lose content. Benefits: It's a sentence listing benefits; we can make
        • for each benefit. Pay: It's a sentence with salary range; we can put in

          . Schedule: sentence;

          . We also need to include minor metadata like REQ# maybe fold into short

          or drop. The instruction: do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

          or drop it. So we can include a

          for REQ# maybe at end. Also need to remove boilerplate: EEO, etc. At end there is "Guild Mortgage Company is an Equal Opportunity Employer. REQ#: ITTHI018470". We'll keep REQ# in a short paragraph, drop EEO statement. Now construct HTML. Structure:

          About the role

          Position Summary The IT Third-Party Controls Analyst supports the governance, monitoring, and control of Guild's third-party relationships and external business partner access throughout the engagement lifecycle. This includes offshore staffing, SaaS/cloud providers, outsourced service providers, contractors, and non-standard access models where external users may receive elevated or internal-like access to Guild systems. Under general supervision, the role executes and monitors IT General Controls that reduce third-party and external-user risk, including due diligence support, engagement classification, access and identity oversight, provisioning and deprovisioning controls, data protection, incident response, governance reporting, and remediation tracking. The role partners with IT Governance, Information Security, IT Operations, IAM, Vendor Management, HR, Legal/Compliance, and other stakeholders to ensure access models, least-privilege controls, certifications, monitoring expectations, and onboarding/offboarding processes are appropriately defined, documented, and maintained.

          But note we need to avoid repeating "Position Summary" maybe we can just start with the content. The heading is About the role; we can put the summary text. We must preserve all substantive information; we can keep the sentences as is. Now Responsibilities:

          Responsibilities

          • Serve as the IT General Controls contact for third-party technology relationships, including offshore staffing, SaaS/cloud providers, outsourced services, contractors, and staff augmentation.
          • Document third-party due diligence and approval updates and partner with IT and Compliance to keep third-party records current.
          • Translate completed due diligence and risk assessment findings into operational control requirements, ensuring identified risks are addressed through appropriately designed controls prior to go-live.
          • Own third-party engagement classification and setup, ensuring new offshore roles, contractor engagements, and outsourced arrangements are properly configured before onboarding.
          • Review third-party roles and access to confirm they match job function and least-privilege requirements.
          • Support governance and control oversight for external business partner users with elevated or internal-like access to Guild systems, including validation that access models, approved roles, identity attributes, and monitoring requirements are clearly defined and documented.
          • Coordinate periodic access certifications for third-party and external business partner users, confirming continued business need, appropriate branch/location segmentation, least-privilege alignment, and timely removal or adjustment of access no longer required.
          • Monitor virtual desktop and third-party access controls to ensure control effectiveness.
          • Track MFA enrollment and re-enrollment controls for third-party users, escalating gaps to IT Operations and Information Security as needed.
          • Oversee controls for external business partner users with elevated or internal-like access, including access models, approved roles, identity attributes, and monitoring requirements.
          • Coordinate access certifications for third-party and external business partner users, confirming business needs, segmentation, least privilege, and timely access removal or adjustment.
          • Track remediation for non-standard external access risks, including identity gaps, manual provisioning, over-provisioning, incomplete deprovisioning, and missing enhanced monitoring.
          • Work with IT and business stakeholders to confirm third-party access, identity, and provisioning controls remain properly scoped throughout the relationship.
          • Monitor IT General Controls across the third-party lifecycle to confirm vendors, offshore resources, and contractors remain within approved control parameters.
          • Monitor DLP controls for third-party relationships, including VDI, no-print, no-download, record retention, and data-handling requirements, with IT Governance and Information Security.
          • Monitor endpoint protection and CASB/Zscaler controls for third-party and offshore endpoints to confirm compliance with security policies.
          • Coordinate White Room setup and control validation for high-risk third-party engagements requiring enhanced physical or logical security.
          • Manage third-party role and scope changes, ensuring changes are documented, approved, and communicated to affected teams.
          • Track control issues, gaps, and remediation activities from monitoring, incidents, or audits.
          • Maintain accurate documentation and coordinate with the IT Third-Party Risk Analyst to align remediation plans.
          • Plan and facilitate third-party incident tabletop exercises, documenting execution and results.
          • Own third-party incident escalation and reporting activities, ensuring incidents are logged, escalated, and tracked to resolution.
          • Prepare periodic third-party risk reporting for oversight and Governance Committees, including control performance, open issues, remediation status, evidence, metrics, and KRI support.
          • Support third-party Business Continuity Planning (BCP) and Disaster Recovery (DR) planning and annual testing activities.
          • Support internal and external audits and regulatory examinations related to third-party IT General Controls by providing control documentation, evidence, and walkthrough support.
          • Monitor third-party offboarding and exit controls, confirming timely removal of system and physical access and closure of contractual and data obligations when engagements end or change.
          • Track and support remediation of control gaps related to non-standard external access models, including inconsistent identity domains, manual provisioning processes, over-provisioned access, incomplete deprovisioning, or insufficient enhanced monitoring.
          • Support third-party oversight, governance activities, risk classification, location reviews, contract management, and engagement intake.
          • Maintain the third-party control library, including process flows, procedure documentation, and control narratives, in coordination with the broader IT team and the IT Third-Party Risk Analyst.
          • Produce deliverables including process flows, procedure documentation, and specialized assessment reports related to third-party processes, tools, metrics, and communication activities.
          • Serve as an advisor to the IT General Controls Manager on third-party control matters and act as a liaison between IT Governance, Vendor Management, Corporate Initiatives, IT Operations, Information Security, HR, Legal, Compliance, and other stakeholders.
          • Assist in maintaining Guild's compliance with applicable regulatory requirements as they relate to third-party staffing, sourcing, and operations.
          • Champion awareness and understanding of third-party control requirements through training, presentations, and regular communication.
          • Drive a culture of continuous improvement and customer service excellence, with visible metrics and KPIs specific to third-party control performance.
          • Monitor industry best practices related to third-party control frameworks and recommend enhancements to the IT General Controls Manager.
          • Perform other duties as assigned.
          Now Qualifications:

          Qualifications

          • Bachelor’s degree in Business Administration, Information Technology, or a related field, or an equivalent combination of education and experience.
          • Minimum Five Years of Experience in IT Operations, Security, Risk, Audit, Vendor/Third-Party Risk Management, and/or offshore/outsourced staffing program administration.
          • Ability to work independently and collaboratively within a team environment.
          • Knowledge of access reviews, third-party/vendor risk management, and IT General Controls audits required.
          • Experience supporting or coordinating offshore/outsourced staffing, SaaS/cloud vendors, or IT contractor programs strongly preferred.
          • Ability to partner effectively with risk and governance functions, translating due diligence and risk assessment findings into operational controls.
          • Technical Project Management and/or Business Analysis experience preferred.
          • Demonstrated ability to analyze and manipulate data across various sources including Excel, CRMs, GRC platforms, and online repositories.
          • Ability to create, improve, and maintain IT processes.
          • Process modeling and procedure development experience preferred.
          • Ability to interpret and explain complex IT systems, third-party relationships, and operations to varied audiences.
          • Advanced proficiency in Microsoft Word, Excel, and PowerPoint required.
          • Experience with GRC tools, vendor risk management platforms, project management tools, and IT asset-management platforms preferred.
          • Understanding of systems development lifecycle and change management concepts.
          • Understanding of financial institution governance and regulations including SSAE 16/18, FFIEC, and ISACA/COBIT.
          • Excellent organization and time-management skills.
          • Strong presentation and communication skills.
          • Ability to summarize large amounts of information and data for executive audiences.
          • Willingness to take ownership of processes, projects, and deliverables.
          • Customer-focused and results-oriented.
          • Ability to establish and meet critical deadlines.
          • Ability to prioritize multiple activities and complex projects simultaneously.
          • Strong research and problem-solving skills.
          • Commitment to company values.Customer Service - Proactive attention to each personIntegrity - Do and say what's rightRespect - Treat others with dignityCollaboration - Listen and work togetherLearning - Seek knowledge and strive for improvementExcellence – Deliver the unexpected
          Note the last item includes the values list; we keep