Specialist, Third Party Operations

Specialist, Third-Party Operations – Third-Party Risk ManagementLocation: New York, NYSchedule/Shift: 8-hour workday; fully onsite for the first 30 days, then hybrid with a minimum of 3 days onsite per weekPay: $50–$62.50 per hour

While professional experience and qualifications are key for this role, make sure to check you have the preferable soft skills before applying if required.
Job SummaryThe Third-Party Risk Management Specialist independently conducts vendor risk assessments to evaluate cybersecurity controls, data privacy practices, regulatory compliance, and potential business risks. This role reviews vendor documentation and security evidence, identifies control gaps, assigns risk ratings, and documents findings and recommendations to support informed business decisions. The specialist manages assessments throughout the third-party lifecycle, monitors remediation activities, and collaborates with Procurement, Legal, Information Security, Privacy, and other stakeholders to strengthen risk management practices.Job ResponsibilitiesIndependently conduct and complete third-party risk assessments, including reviewing evidence, evaluating controls, identifying deficiencies, and documenting risk ratings and recommendations.Evaluate vendor security controls when SOC 2 Type II reports or equivalent certifications are unavailable by reviewing security policies, ISO certifications, penetration testing results, and other independent evidence.Assess third-party risks related to cybersecurity, data privacy, personally identifiable information (PII), regulatory compliance, and Payment Card Industry (PCI) requirements.Review vendor security questionnaires, including Standardized Information Gathering (SIG) assessments, validate responses against supporting evidence, identify inconsistencies, and request clarification when needed.Use third-party risk management (TPRM) and governance, risk, and compliance (GRC) platforms to manage assessments, document findings, and track remediation activities.Conduct ongoing monitoring and periodic reassessments in response to security incidents, regulatory changes, financial concerns, ownership changes, and subcontractor changes.Evaluate control effectiveness and recommend remediation plans or other risk mitigation measures.Support third-party due diligence, risk assessment, approval, monitoring, and offboarding processes.Track and report risk metrics, including assessment timelines, outstanding high-risk findings, and remediation progress.Collaborate with Procurement, Legal, Information Security, Privacy, Risk Management, and business stakeholders to communicate assessment outcomes and support risk-based decisions.Evaluate relevant business and financial risks, including insurance-related considerations such as underwriting, claims, fraud, and financial exposure.Contribute to improvements in risk assessment procedures, monitoring practices, and the overall TPRM framework.Job RequirementsMinimum 3 years of relevant professional experience, with demonstrated hands-on responsibility for independently conducting and completing third-party risk assessments.Experience reviewing vendor documentation and technical evidence, evaluating security controls, identifying deficiencies, and documenting assessment conclusions and recommendations.Working knowledge of cybersecurity risk management, data privacy, PII protection, and applicable regulatory requirements, including GDPR, CCPA, and PCI considerations.Experience reviewing SOC reports, ISO certifications, security policies, penetration testing results, and other vendor security evidence.Experience analyzing SIG or comparable vendor risk questionnaires and validating vendor responses against supporting documentation.Practical experience with enterprise TPRM or GRC platforms, such as KY3P, Archer, ServiceNow, Aravo, Coupa, or Mitratech/Prevalent.Understanding of continuous monitoring, ongoing monitoring, risk remediation, periodic reassessments, and third-party risk reporting.Strong analytical, critical-thinking, documentation, and communication skills.Ability to exercise sound risk judgment, work independently, and collaborate effectively with technical and business stakeholders.Bachelor's degree in a related field.Preferred QualificationsExperience with KY3P or other enterprise third-party risk management platforms.Experience assessing vendors in regulated industries, particularly financial services or insurance.Familiarity with emerging third-party risks, including cybersecurity threats, geopolitical developments, and supply chain disruptions.Experience evaluating PCI compliance documentation, including Attestations of Compliance (AOCs) and Reports on Compliance (ROCs). xzbcwsv Experience improving TPRM workflows, assessment processes, reporting, and risk monitoring practices.