Senior Third-Party Risk Management (TPRM) Analyst

Join a leading organization at the forefront of innovation, dedicated to safeguarding critical operations and sensitive data. Partnering with Aquent, this company is committed to maintaining robust security postures and ensuring the integrity of its extended enterprise, playing a crucial role in delivering essential services and protecting valuable information.

Make a direct and profound impact on our organization's security landscape! We are seeking a highly skilled and proactive Analyst to take the lead in protecting our vital assets and ensuring compliance. In this pivotal role, you will be the driving force behind our third-party risk assessments, directly influencing strategic decisions and fortifying our defenses against evolving threats. Your expertise will be critical in identifying vulnerabilities, mitigating risks, and contributing to a resilient and secure operational environment, shaping the future of our security posture.

What You'll Do

• Independently conduct and complete comprehensive third-party risk assessments, evaluating vendor risk, scrutinizing supporting evidence, identifying control gaps, and meticulously documenting risk ratings, findings, and recommendations.
• Evaluate vendor security controls, including security policies, ISO certifications, penetration testing results, and other independent assessments, particularly when SOC 2 Type II or equivalent certifications are unavailable.
• Assess third-party risks related to cybersecurity, data privacy, personally identifiable information (PII), applicable regulatory requirements, and Payment Card Industry (PCI) compliance.
• Review and analyze vendor security questionnaires, such as Standardized Information Gathering (SIG) assessments, validating responses against supporting documentation, identifying inconsistencies, and obtaining clarification or additional evidence as needed.
• Leverage enterprise third-party risk management and governance, risk, and compliance (GRC) platforms, including KY3P, to manage assessments, document findings, track remediation activities, and support effective risk workflows.
• Conduct ongoing risk monitoring and reassessments in response to material changes, including security incidents, regulatory shifts, financial concerns, ownership changes, or changes involving subcontractors.
• Evaluate the effectiveness of vendor risk controls and recommend appropriate remediation or risk mitigation measures based on assessment findings.
• Contribute to the continuous improvement of the third-party risk management framework across the entire vendor lifecycle, from due diligence and risk assessment to approval, monitoring, and offboarding.
• Track and report key risk metrics, including assessment completion timelines, outstanding high-risk findings, and remediation progress, providing actionable insights to stakeholders.
• Collaborate effectively with cross-functional teams, including Procurement, Legal, Information Security, Privacy, Risk Management, and business stakeholders, to communicate assessment results and support risk-based decisions.
• Apply a nuanced understanding of business and financial risk, including insurance-related considerations such as underwriting, claims, fraud, and financial exposure, where applicable.

What You'll Bring

Must-Have Qualifications

• Demonstrated hands-on experience independently conducting, analyzing, and completing third-party risk assessments as a primary job responsibility.
• Proven experience reviewing vendor documentation and technical evidence, evaluating the effectiveness of security controls, identifying risks and deficiencies, and documenting assessment conclusions and recommendations.
• Working knowledge of cybersecurity risk management, data privacy, PII protection, and relevant regulatory and compliance requirements, including GDPR/CCPA and PCI considerations.
• Experience reviewing SOC reports, ISO certifications, security policies, penetration testing results, and other evidence used to evaluate vendor risk.
• Experience analyzing SIG or comparable vendor risk questionnaires and validating vendor-provided responses against supporting documentation.
• Practical experience with enterprise third-party risk management (TPRM) or GRC platforms, including KY3P, Archer, ServiceNow, Aravo, Coupa, or Mitratech/Prevalent.

What Will Set You Apart

• A comprehensive understanding of ongoing and continuous monitoring, risk remediation strategies, periodic reassessments, and sophisticated third-party risk reporting and metrics.
• Exceptional analytical, critical-thinking, and documentation skills, coupled with the ability to clearly articulate complex risk findings and recommend appropriate next steps to diverse audiences.
• A proven ability to work independently, exercise sound risk judgment, and collaborate effectively with both technical and business stakeholders to achieve shared security objectives.