Technology Service Provider Manager

The Technology Service Provider Manager provides dedicated risk-based oversight of Team Super’s technology service providers so that vendor performance, assurance evidence, cyber controls, AI-related risks and contractual obligations are managed consistently across the vendor lifecycle. The role has a clear focus on strengthening ongoing assurance over technology vendor controls, including APRA CPS 230 Operational Risk Management and APRA CPS 234 Information Security requirements.

The Service Provider Manager is responsible for the end-to-end management, monitoring and oversight of Team Super’s technology service providers and vendors. The role supports the Service Provider Owner and Technology leadership team by coordinating vendor selection, classification, due diligence, technology risk assessment, contract governance, performance monitoring, issue management, reporting and renewal/offboarding activities.

Key Responsibilities

• Manage the technology vendor lifecycle from identification of need through evaluation, onboarding, ongoing monitoring, renewal, change management and offboarding.

• Complete and maintain service provider materiality and classification assessments, including identifying Material Service Providers, core technology services, critical operation dependencies and Technology Risk Assessment requirements.

• Coordinate initial and annual due diligence for technology vendors, including obtaining vendor responses, assessing due diligence outcomes, documenting evidence and ensuring records are uploaded and maintained in Gatekeeper.

• Lead the uplift from point-in-time vendor assurance to continuous assurance for technology vendors, with monthly reporting and meeting cadences that monitor control effectiveness, risk posture, remediation progress and emerging technology risks.

• Establish and maintain CPS 234-focused reporting expectations with technology vendors, including information security controls, cyber incidents, material control weaknesses, penetration testing outcomes, vulnerability management, security attestations, independent assurance, access controls, data protection and resilience indicators.

• Work with Line 1 Risk, Technology Line 1 Risk and Line 2 Risk to support financial, non-financial, technology, cyber, data/privacy, business continuity, fourth-party, offshoring, concentration and compliance risk assessments.

• Partner with Legal, Technology stakeholders and vendors to support contract review, statement of work development, SLA/KPI definition, negotiation inputs, execution workflows and contract record management.

• Embed AI governance expectations into vendor oversight, including transparency over vendor AI use, AI-enabled services, model/data governance, human oversight, security and privacy controls, regulatory alignment, responsible AI practices and escalation of material AI-related risks.

• Monitor vendor preparedness for frontier AI developments, including emerging AI-enabled cyber threats, data leakage risks, model misuse, automation risk, third-party AI dependency, operational resilience impacts and opportunities to safely improve service delivery.

• Monitor vendor performance against agreed service levels, contractual obligations, incident notification requirements, control expectations, risk provisions and remediation actions.

• Coordinate regular operational, management and executive vendor meetings as required by vendor classification, ensuring actions, decisions, issues and escalations are documented and followed through.

• Maintain accurate vendor records in Gatekeeper, including contracts, due diligence artefacts, risk assessments, materiality decisions, Technology Risk Assessments, assurance reports, attestations, CPS 234 evidence, AI governance records, meeting records, incidents, issues and renewal dates.

• Support monthly, quarterly and ad hoc reporting on technology vendors, including performance, risks, control effectiveness, CPS 234 compliance, AI utilisation, AI governance, incidents, issues, fourth-party dependencies, business continuity arrangements and compliance with agreements.

• Identify, document and escalate vendor incidents, issues, breaches, control weaknesses, major changes, material offshoring matters, AI-related risks and potential APRA notification triggers in line with internal procedures.

• Support supplier contingency planning for technology Material Service Providers, including exit and transition considerations, continuity arrangements, data return/destruction requirements and resilience impacts.

• Drive timely completion of annual due diligence, risk refreshes, contract renewals and extension requirements, including coordinating approvals, reviews and escalations where required.

• Promote consistent, risk-based vendor management practices across the Technology function and provide guidance to stakeholders on service provider governance, CPS 234 assurance and AI governance requirements.

Qualifications:

• Mandatory: Relevant tertiary qualification or equivalent experience in technology, business, risk, governance, procurement, commercial management, vendor management or a related discipline.

• Mandatory: Demonstrated experience managing technology vendors, supplier relationships, contracts, service levels, risk controls, cyber assurance or third-party assurance activities.

• Desired: Knowledge of APRA CPS 230 Operational Risk Management and APRA CPS 234 Information Security requirements, prudential service provider obligations, operational resilience, outsourcing/vendor governance or regulated financial services environments.

• Desired: Experience with technology risk, cyber risk, privacy, business continuity, cloud/SaaS vendor assessment, third-party risk management, continuous assurance and service assurance.

• Desired: Understanding of AI governance, responsible AI practices, AI risk management, vendor use of AI-enabled services and emerging frontier AI risk considerations.

• Desired: Familiarity with vendor and contract management systems such as Gatekeeper, and governance, risk and compliance systems such as Protecht ERM.

Skills & Experience

• Essential: Technology Vendor Management experience in the Banking and Financial Services industry.

• Strong relationship management skills with the ability to engage vendors, technology teams, risk, legal, finance, executives and governance forums.

• Sound commercial and analytical judgement, with the ability to assess vendor performance, risk information, assurance evidence, CPS 234 control evidence, AI utilisation information and contractual obligations.

• Excellent written communication skills, including the ability to prepare clear monthly reporting, meeting records, risk summaries, assurance updates, escalation papers and vendor governance documentation.

• Strong planning and coordination capability, with the ability to manage multiple vendor activities, deadlines, reviews, renewals, reporting cycles and follow-up actions.

• Working knowledge of SLAs, KPIs, service credits, incident management, control assurance, audit reports, attestations, business continuity plans, technology risk assessments and information security assurance.

• Ability to define and mature continuous assurance expectations with vendors, including evidence requirements, recurring reporting, control health indicators, remediation tracking and escalation thresholds.

• Awareness of AI governance, responsible AI, AI-enabled service delivery, vendor AI disclosure expectations and emerging frontier AI risks relevant to technology service providers.

• High attention to detail and strong record-keeping discipline to maintain accurate evidence, approvals and audit trails.

• Ability to operate in a regulated environment and apply policy, procedure, risk appetite and governance requirements pragmatically.

• Collaborative, proactive and outcomes-focused approach, with a commitment to member-first decision making and continuous improvement.

If this sounds like you we would love to hear from you.