Third Party Risk Assessment Analyst

About the Role

The Third-Party Risk Assessor will collaborate with internal business units, cross-functional partners, and external vendor teams to evaluate end-to-end third-party risks. The role focuses on identifying vulnerabilities, assessing control environments, and establishing mitigation frameworks across multiple critical operational and regulatory risk domains.

Responsibilities

• Due Diligence & Screening
• Define, execute, and integrate risk domain screenings into vendor onboarding workflows and continuous monitoring plans.
• Risk Assessments & Audits
• Lead joint domain evaluations including scope definition, control testing, stakeholder interviews, evidence review, finding prioritization, and remediation tracking.
• Ongoing Vendor Governance
• Carry out periodic monitoring routines aligned with the inherent risk profile of third-party engagements.
• Offboarding & Exit Strategy
• Establish risk domain requirements for offboarding, contract terminations, and secure vendor offboarding activities.
• TPRM Tooling & Questionnaire Refinement
• Review and update domain-specific logic within Inherent Risk Questionnaires (IRQs) to ensure accurate initial risk tiering.
• Mitigation & Control Advisory
• Advise on targeted controls to remediate identified gaps and determine acceptable post-remediation residual risk levels.
• Standardization & Risk Scoring
• Establish qualitative risk-scoring criteria consistent with the overarching enterprise risk taxonomy and framework.
• Education & Capability Building
• Promote risk awareness, share best practices internally, and provide guidance to third-party vendors.
• Metrics & Reporting
• Monitor and report on key process indicators (KPIs) and control effectiveness metrics to support executive decision-making.

Qualifications

• Education / Credentials
• Bachelor’s degree or relevant professional certifications (e.g., CTPRP, CISA, CRISC, CISM, CIPP, CIPT).

Required Skills

• Domain Experience
• 3+ years in third-party risk management (TPRM), operational risk, internal/external audit, or enterprise risk governance.
• Framework Knowledge
• Strong command of risk assessment methodologies, internal control frameworks, and industry best practices.
• Regulated Environments
• Proven ability to navigate complex, highly regulated operating environments and matrix structures.
• Execution & Autonomy
• Strong self-management skills to prioritize deliverables, manage dynamic workloads, and drive initiatives independently.
• Stakeholder Management
• Excellent communication, analytical, and influencing capabilities with a track record of building cross-functional partnerships.

Preferred Skills

• Overview & Context
• This opportunity is with a leading, highly regulated global enterprise operating in a multi-stakeholder environment.
• The organization is expanding its centralized Third-Party Risk Management (TPRM) function to evaluate, mitigate, and govern external vendor risks across diverse domains including cybersecurity, data privacy, business continuity, regulatory compliance, and operational resilience.