Senior Third-Party Risk Management (TPRM) Analyst [213499]

Skill · New york, United States

Hybrid in Union Square a few days per week. 
We’re seeking an experienced Senior Third-Party Risk Management (TPRM) Analyst to independently conduct and complete third-party risk assessments. This role is responsible for evaluating vendor security controls, analyzing supporting documentation, identifying potential risks and control gaps, and documenting findings and recommendations to support informed risk decisions. The ideal candidate will have hands-on experience managing TPRM assessments from initial review through documented conclusions, a strong understanding of cybersecurity, data privacy, and regulatory compliance, and practical experience using enterprise TPRM platforms, including KY3P. This is a technical risk management role requiring direct assessment ownership, not primarily supplier onboarding, administrative coordination, or documentation management.
 
Job Responsibilities
 Independently conduct and complete third-party risk assessments, evaluating vendor risk, reviewing supporting evidence, identifying control gaps, and documenting risk ratings, findings, and recommendations.
 Evaluate vendor security controls and alternative evidence when SOC 2 Type II or equivalent certifications are unavailable, including security policies, ISO certifications, penetration testing results, and other independent assessments.
 Assess third-party risks related to cybersecurity, data privacy, personally identifiable information (PII), applicable regulatory requirements, and Payment Card Industry (PCI) compliance.
 Review and analyze vendor security questionnaires, including Standardized Information Gathering (SIG) assessments, validate responses against supporting documentation, identify inconsistencies, and obtain clarification or additional evidence when needed.
 Use third-party risk management and governance, risk, and compliance (GRC) platforms to manage assessments, document findings, track remediation activities, and support effective risk workflows. Experience with KY3P is particularly relevant.

 Conduct ongoing risk monitoring and reassessments when material changes occur, including security incidents, regulatory changes, financial concerns, ownership changes, or changes involving subcontractors.
 Evaluate the effectiveness of vendor risk controls and recommend appropriate remediation or risk mitigation measures based on assessment findings.
 Contribute to the effectiveness of the TPRM framework across the vendor lifecycle, including due diligence, risk assessment, approval, monitoring, and offboarding.
 Track and report risk metrics, including assessment completion timelines, outstanding high-risk findings, and remediation progress.
 Collaborate with Procurement, Legal, Information Security, Privacy, Risk Management, and business stakeholders to communicate assessment results and support risk-based decisions.
 Apply an understanding of business and financial risk, including insurance-related considerations such as underwriting, claims, fraud, and financial exposure, where applicable.
 
Experience/Qualifications
 Demonstrated hands-on experience independently conducting, analyzing, and completing third-party risk assessments as a primary job responsibility.
 Experience reviewing vendor documentation and technical evidence, evaluating the effectiveness of security controls, identifying risks and deficiencies, and documenting assessment conclusions and recommendations.
 Working knowledge of cybersecurity risk management, data privacy, PII protection, and relevant regulatory and compliance requirements, including GDPR/CCPA and PCI considerations.
 Experience reviewing SOC reports, ISO certifications, security policies, penetration testing results, and other evidence used to evaluate vendor risk.
 Experience analyzing SIG or comparable vendor risk questionnaires and validating vendor-provided responses against supporting documentation.
 Practical experience with enterprise TPRM or GRC platforms, including KY3P, Archer, ServiceNow, Aravo, Coupa, or Mitratech/Prevalent.

 Understanding of ongoing and continuous monitoring, risk remediation, periodic reassessments, and third-party risk reporting and metrics.
 Strong analytical, critical-thinking, documentation, and communication skills, including the ability to explain risk findings and recommend appropriate next steps.
 Ability to work independently, exercise sound risk judgment, and collaborate effectively with technical and business stakeholders.

#LI-Hybrid