Description
The TPRM Risk Analyst will operate in a risk-based, data-driven model to manage third-party risk, ensuring compliance with regulations and stakeholder expectations. The ideal candidate will have 7-10 years of experience in Third-Party Risk Management (TPRM) or Governance, Risk & Compliance (GRC).
Responsibilities:
- Risk Assessment Validation & Remediation:
- Manage the full lifecycle of a third-party relationship from sourcing to payment.
- Validate inherent risk ratings and criticality designations for third-party relationships.
- Review third-party provided information and documentation for gaps or follow-up questions.
- Lead communication to third parties to remediate gaps for high-risk and critical relationships.
- Reporting & Trend Analysis:
- Lead portfolio-level trend analysis and build leadership- and audit-facing reporting.
- Translate findings into risk-based recommendations.
- Oversight & Periodic Review:
- Identify, track, and review the adequacy of completion of SME reviews and assessments.
- Provide oversight of the periodic review process, escalating higher-risk findings or gaps.
- Mentorship & Stakeholder Support:
- Mentor the Associate TPRM Risk Analyst and support the TPRM Manager in audit and customer discussions.
Requirements:
- Experience & Education:
- 7-10 years of experience in TPRM or GRC.
- Demonstrated experience performing substantive risk assessments and applying formula-based risk methodologies.
- Bachelor’s degree in a relevant field (Cybersecurity, Business, Information Systems).
- Certifications (at least one required): CRISC, CISM, CTPRP, or CRVPM.
- Technical & Operational Proficiency:
- Proficiency with a well-established TPRM platform.
- Deep operational understanding of standard control frameworks (NIST SP 800-53, ISO 27001, SOC 2, SIG Core/Lite, CAIQ).
- Core Competencies:
- Analytical Rigor: ability to interpret data and apply risk knowledge and judgment.
- Communication: ability to translate portfolio-level findings into clear risk recommendations.
- Check-and-Challenge: comfort with constructive challenge of third-party or SME responses.
- Leadership: ability to mentor junior team members and represent TPRM in audit and customer-facing discussions.