Senior Third-Party Risk Management (TPRM) Analyst [213499]

Hybrid on site in Union Square. We are seeking a Senior Third-Party Risk Management (TPRM) Analyst with hands-on technical assessment expertise to evaluate and mitigate cybersecurity, regulatory, and operational risks across our third-party vendor ecosystem.

The ideal candidate is an experienced individual contributor who dives deep into technical vendor evidence?personally analyzing SOC reports, network architecture, penetration tests, and questionnaire responses to validate controls, identify deficiencies, and formulate actionable risk remediations.

Key Responsibilities

• Hands-on Technical Due Diligence: Plan and execute end-to-end cybersecurity risk assessments for third-party vendors, suppliers, and SaaS/cloud providers.

• Evidence & Control Evaluation: Conduct line-by-line technical reviews of vendor documentation, including SOC 1 / SOC 2 Type II reports, SIG/CAIQ questionnaires, independent penetration tests, vulnerability scans, and architectural data-flow diagrams.

• Exception & Gap Management: Analyze audit exceptions and evaluate vendor management responses. Structure binding Corrective Action Plans (CAPs), establish formal 60-to-90 day remediation milestones, and define robust compensating controls when standard certifications are missing.

• Shared Responsibility & PCI Reviews: Review PCI Attestations of Compliance (AOC) and Reports on Compliance (ROC); verify scope alignment and identify Complementary User Entity Controls (CUECs) or shared responsibility requirements that fall on the internal organization.

• Continuous & Ongoing Monitoring: Leverage external security ratings and threat intelligence platforms to monitor supplier security posture in real time. Evaluate risk alerts, material changes, and security incidents to trigger targeted reassessments.

• Stakeholder & Business Partnership: Act as a pragmatic, trusted risk advisor to business units and procurement. Articulate technical risks in clear business terms, balance operational needs with security governance, and prepare executive risk summaries for leadership sign-off without unnecessarily stalling business initiatives.

• Platform Administration & Workflow Optimization: Manage vendor records, assessment lifecycles, and risk registers within enterprise GRC platforms, enhancing automation and assessment turnaround times.

Qualifications & Experience

• Experience: 5+ years of dedicated, hands-on experience in Third-Party Risk Management (TPRM), Vendor Risk Assessment (VRM), or Information Security Risk.

• Technical Depth: Proven ability to dissect SOC 2 Type II Section IV testing matrices, evaluate CUECs, review web/network penetration testing summaries, and interpret cloud security architectures (AWS/Azure).

• Framework Fluency: Strong working knowledge of industry standards and regulatory frameworks, including NIST CSF / 800-53, ISO/IEC 27001, SOC 2 Trust Services Criteria, PCI-DSS, GDPR, CCPA, and NYDFS Part 500. Exposure to critical infrastructure or energy standards (e.g., NERC CIP) is a strong plus.

• Tooling Proficiency: Direct experience working within enterprise GRC/TPRM platforms (e.g., OneTrust, ServiceNow GRC, RSA Archer, ProcessUnity) and continuous threat intelligence tools (e.g., BitSight, SecurityScorecard, Black Kite, RiskRecon).

• Certifications (Preferred): CISA, CRISC, CISSP, CTPRP, or ISO 27001 Lead Auditor.

• Education: Bachelor?s degree in Cybersecurity, Information Systems, Computer Science, or a related field (or equivalent practical experience).

#LI-Hybrid