Senior Analyst TPRM

Key Responsibilities

Core TPRM Activities

• Support TPRM activities including vendor onboarding, annual vendor reviews, key vendor changes and vendor audits
• Align TPRM activities to current industry best practices
• Support management reporting
• Maintain an inventory of critical thirdparty vendors and systems
• Conduct thirdparty risk assessments covering operational, technology, resilience and other risks arising from third party relationships
• Identify key third-party risks
• Recommend and document risk mitigation action plans
• Work with internal and external stakeholders to track mitigation action plans to closure
• Assessing third-party Information Security controls and risks, including access management, data protection, vulnerability management, incident response, and security assurance.
• Review independent assurance reports received from vendors (e.g., SOC 1 / SOC 2, ISO certifications, BCP test summaries) to identify control gaps and mitigate key risks.
• Review of vendor BIAs, RTOs, RPOs, recovery strategies, DR architecture and exercise/test results.
• Assess vendor recovery capabilities, identify key business disruption risks from vendor outages and vendor control gaps, and document key risk mitigation strategies.
• Follow-up on vendor action plans and track remediation plans to closure.

Required Handson TPRM Experience

• Conducting/managing TPRM activities
• Reviewing and assessing vendor SOC reports and thirdparty assurance reports
• Performing vendor risk assessments and documenting findings
• Strong written and verbal communication skills and stakeholder management with the ability to present risk in business terms.

Required Qualifications

• Graduate degree with 35 years of hands-on experience in ThirdParty / Vendor Risk Management.
• Demonstrated Information Security experience, including evaluating third-party security controls and technology risks.

Preferred Qualifications & Certifications

• CTPRA / CTPRP – Certified ThirdParty Risk Assessor / Professional
• CRISC – Certified in Risk and Information Systems Control
• Experience evaluating vendor BCP/DR programs and operational resilience capabilities is preferred
• CBCP – Certified Business Continuity Professional
• Certifications in BCP/DR governance or Information Security are a plus