Job Description

Senior Third-Party Risk Management (TPRM) Analyst

Pay Rate: Up to $62.50 per hour

Job Type: Contract (Assigment with a Swipejobs staffing)

Location: NY NY

Experience, qualification, and soft skills, have you got everything required to succeed in this opportunity Find out below.

Job Summary

Seeking an experienced Senior Third-Party Risk Management (TPRM) Analyst to independently conduct, analyze, and complete third-party risk assessments. This role focuses on evaluating vendor security controls, reviewing technical and compliance documentation, identifying potential risks and control gaps, and documenting findings and recommendations to support informed, risk-based decisions. The ideal candidate will have hands-on experience managing third-party risk assessments from initial review through final conclusions, along with a strong understanding of cybersecurity, data privacy, and regulatory compliance. Experience with enterprise third-party risk management (TPRM) and governance, risk, and compliance (GRC) platforms, particularly KY3P, is highly desirable. This is a hands-on technical risk management position requiring direct ownership of risk assessments rather than a role focused primarily on vendor onboarding, administrative coordination, or document management.

Responsibilities

• Independently conduct and complete third-party risk assessments, including reviewing vendor evidence, evaluating controls, identifying deficiencies, and documenting risk ratings, findings, and recommendations.
• Assess vendor security controls when SOC 2 Type II reports or equivalent certifications are unavailable, using alternative evidence such as security policies, ISO certifications, penetration testing results, and independent assessments.
• Evaluate third-party risks related to cybersecurity, data privacy, personally identifiable information (PII), regulatory compliance, and Payment Card Industry (PCI) requirements.
• Analyze vendor security questionnaires, including Standardized Information Gathering (SIG) assessments, and validate responses against supporting documentation.
• Identify inconsistencies in vendor responses and request additional information or evidence as needed.
• Utilize enterprise TPRM and GRC platforms to manage assessments, document findings, track remediation activities, and maintain effective risk workflows.
• Conduct ongoing monitoring and periodic reassessments in response to security incidents, regulatory changes, financial concerns, ownership changes, and subcontractor changes.
• Evaluate the effectiveness of vendor controls and recommend appropriate remediation or risk mitigation measures.
• Support the TPRM framework throughout the vendor lifecycle, including due diligence, risk assessment, approval, monitoring, and offboarding.
• Track and report risk metrics, including assessment completion timelines, outstanding high-risk findings, and remediation progress.
• Collaborate with Procurement, Legal, Information Security, Privacy, Risk Management, and business stakeholders to communicate findings and support risk-based decisions.
• Apply business and financial risk knowledge, including relevant insurance considerations involving underwriting, claims, fraud, and financial exposure.

Qualifications

• Required Qualifications and Experience
• Demonstrated hands-on experience independently conducting, analyzing, and completing third-party risk assessments.
• Experience reviewing vendor documentation and technical evidence, evaluating security controls, identifying risks and deficiencies, and documenting conclusions and recommendations.
• Working knowledge of cybersecurity risk management, data privacy, PII protection, and applicable regulatory and compliance requirements, including GDPR, CCPA, and PCI considerations.
• Experience reviewing SOC reports, ISO certifications, security policies, penetration testing results, and other evidence used to evaluate vendor risk.
• Experience analyzing SIG or comparable vendor risk questionnaires and validating vendor responses against supporting documentation.
• Practical experience with enterprise TPRM or GRC platforms, such as KY3P, Archer, ServiceNow, Aravo, Coupa, or Mitratech/Prevalent.
• Understanding of continuous and ongoing monitoring, risk remediation, periodic reassessments, and third-party risk reporting.
• Strong analytical, critical-thinking, documentation, and communication skills, including the ability to explain risk findings and recommend appropriate next steps.
• Ability to work independently, exercise sound risk judgment, and collaborate effectively with technical and business stakeholders.

Required Skills

• Hands-on experience independently conducting, analyzing, and completing third-party risk assessments.
• Ability to review vendor documentation and technical evidence, evaluate security controls, identify risks and deficiencies, and document conclusions and recommendations.
• Working knowledge of cybersecurity risk management, data privacy, PII protection, and applicable regulatory and compliance requirements, including GDPR, CCPA, and PCI considerations.
• Experience reviewing SOC reports, ISO certifications, security policies, penetration testing results, and other evidence used to evaluate vendor risk.
• Experience analyzing SIG or comparable vendor risk questionnaires and validating vendor responses against supporting documentation.
• Practical experience with enterprise TPRM or GRC platforms, such as KY3P, Archer, ServiceNow, Aravo, Coupa, or Mitratech/Prevalent.
• Understanding of continuous and ongoing monitoring, risk remediation, periodic reassessments, and third-party risk reporting.
• Strong analytical, critical-thinking, documentation, and communication skills, including the ability to explain risk findings and recommend appropriate next steps.
• Ability to work independently, exercise sound risk judgment, and collaborate effectively with technical and business stakeholders.

Preferred Skills

• Experience with KY3P or similar enterprise third-party risk management platforms.
• Familiarity with alternative vendor assurance evidence when SOC 2 Type II reports are unavailable.
• Knowledge of emerging cybersecurity, privacy, regulatory, financial, and supply chain risks.
• Experience improving TPRM workflows, assessment quality, risk reporting, and remediation tracking. xhyhwjd
• Familiarity with insurance-related business risks and financial exposure.

How to Apply

Job Tags

Similar Jobs