Cyber Security & Third Party Due Diligence Senior Associate

We need to output HTML fragment with sections: headings

for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. The posting includes: - Intro paragraph about DTCC, mission, etc. Could be "About the role" or maybe "About DTCC". The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we need to decide which sections have content. We have: - About the role: description of role, impact, etc. That's present. - Responsibilities: list of primary responsibilities. - Requirements/Qualifications: qualifications: Minimum of 6 years of related experience, Bachelor's degree preferred or equivalent experience. - Skills: maybe "Talents Needed For Success" but not explicit. There's a line "Talents Needed For Success" but then it goes into salary range statement. Not specific skills. Could treat as Skills? Might be vague. Better not to include Skills if not specific. - Benefits: The posting includes "Pay And Benefits Competitive compensation, including base pay and annual incentive Comprehensive health and life insurance and well-being benefits, based on location Pension / Retirement benefits Paid Time Off and Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being." Also mentions flexible/hybrid model: 3 days onsite 2 days remote (onsite Tuesdays, Wednesdays and a third day unique to each team or employee). That's schedule. - Pay: The posting includes "Competitive compensation, including base pay and annual incentive". Also "The salary range is indicative for roles at the same level within DTCC across all US locations. Actual salary is determined based on the role, location, individual experience, skills, and other considerations." That's pay info but not specific numbers. The instruction says: never create Pay/Schedule/Benefits sections unless the posting actually states them. It does state competitive compensation, base pay, annual incentive, etc. That's enough for Pay section? It says "Competitive compensation, including base pay and annual incentive". That's a statement. So we can include Pay. - Benefits: health insurance, life insurance, well-being, pension/retirement, PTO, etc. So Benefits. - Schedule: flexible/hybrid model 3 days onsite 2 days remote (onsite Tuesdays, Wednesdays and a third day unique). So Schedule. We must not repeat job title as heading. No Job ID. Remove boilerplate: EEO, equal opportunity, accommodation request, etc. Also remove duplicated lines, navigation, cookie, legal, scam-warning. So we strip those. We need to preserve all substantive information. So we need to keep the description about DTCC, role impact, responsibilities list, qualifications, benefits, pay, schedule. We must not invent or summarize away detail. So we need to keep the exact sentences? We can keep them as is but maybe break into

and

. Must not omit any substantive detail. Let's extract. Original text: "Are you ready to make an impact at DTCC? Do you want to work on innovative projects, collaborate with a dynamic and supportive team, and receive investment in your professional development? At DTCC, we are at the forefront of innovation in the financial markets. We are committed to helping our employees grow and succeed. We believe that you have the skills and drive to make a real impact. We foster a thriving internal community and are committed to creating a workplace that looks like the world that we serve. Our Risk Management teams work to protect the safety and soundness of our systems and are responsible for identifying, managing, measuring and mitigating a spectrum of key risk types including credit, market, liquidity, systemic, operational and technology in all existing and new products, activities, processes and systems." That's intro. Then "Pay And Benefits Competitive compensation, including base pay and annual incentive Comprehensive health and life insurance and well-being benefits, based on location Pension / Retirement benefits Paid Time Off and Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being. DTCC offers a flexible/hybrid model of 3 days onsite and 2 days remote (onsite Tuesdays, Wednesdays and a third day unique to each team or employee)." Then "The Impact You Will Have In This Role In this role, you will support the Cyber Security Due Diligence SME team within the Cyber Security Risk Office (CSRO), responsible for overseeing technology, cyber security, and operational resilience risk assessments across DTCC's third party ecosystem. Your work will directly contribute to strengthening DTCC's Third Party Risk Management program by ensuring effective identification, assessment, monitoring, and remediation of cyber and technology risks associated with vendors, service providers, and other external partners. You will work closely with Business, Technology, Legal, Sourcing, Resilience, and Risk Management stakeholders to perform due diligence assessments, third party onboarding activities, control gap remediation, onsite reviews, and specialized assessments, including fourth party risk, NYSDFS cybersecurity reviews, encryption key management, and software supply chain security. The role is also responsible for advancing third party cyber risk reviews, enhancing assessment methodologies, and supporting regulatory compliance." Then "Your Primary Responsibilities Conduct technology, cyber security, operational resilience, and specialized risk assessments of third parties supporting DTCC's critical services Provide subject matter expertise on third-party cyber risk management, emerging regulatory requirements, and industry best practices, including NYSDFS Cybersecurity Regulation, operational resilience requirements, software supply chain risk, fourth-party risk, and encryption key management Partner closely with Sourcing, Legal, Enterprise Program Management, Architecture Review Board (ARB), Technology, Resilience, Security, and Business stakeholders to support third-party onboarding, contract reviews, and risk-based decision making Perform remediation efforts for identified third party control gaps and assessment findings, ensuring appropriate accountability, transparency, and timely risk reduction Build strong relationships with internal and external stakeholders. Partner with other internal stakeholders on third party risk activities. Participate in discussions with internal and external stakeholders to plan and execute on process enhancements Demonstrate effective written and verbal communication skills, active engagement in meetings and thought leadership. Provide guidance to internal stakeholders on processes and address issues and inquiries timely. Prioritize multiple tasks and initiatives. Lead the execution of Third Party Risk Management frameworks and manage project tasks effectively. Demonstrate and apply a thorough understanding of risk management processes and activities, with specific focus on key third party risks. Viewed as a subject matter expert. Aligns risk and control processes into day to day responsibilities to monitor and mitigate risk; escalates appropriately Ensure third-party cyber risk management activities support DTCC's overall risk ma" Note the last sentence truncated: "support DTCC's overall risk ma". Probably cut off but we keep as is? It's incomplete; but we must preserve all substantive information; we cannot invent. We'll keep the truncated sentence as is? Might be better to keep until "risk ma". But it's incomplete; maybe it's a mistake. We'll keep as is. Then "Qualifications Minimum of 6 years of related experience Bachelor's degree preferred or equivalent experience" Then "Talents Needed For Success The salary range is indicative for roles at the same level within DTCC across all US locations. Actual salary is determined based on the role, location, individual experience, skills, and other considerations." Then EEO boilerplate etc which we remove. Thus sections: - About the role: could combine intro + impact? The instruction says use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we need to decide which headings to use. We have content for: - About the role: we have introductory paragraphs about DTCC and the role impact. Could be "About the role". We'll include that. - Responsibilities: we have "Your Primary Responsibilities" list. - Requirements: maybe we combine Qualifications and Talents? But we have Qualifications section: Minimum of 6 years... Bachelor's degree preferred. That's qualifications. - Skills: Not explicit; we could skip. - Benefits: we have health insurance etc. - Pay: we have competitive compensation etc. - Schedule: flexible/hybrid model. We must not create sections with filler like "commensurate with experience". We have actual content. Thus output:

About the role

Are you ready to make an impact at DTCC? Do you want to work on innovative projects, collaborate with a dynamic and supportive team, and receive investment in your professional development? At DTCC, we are at the forefront of innovation in the financial markets. We are committed to helping our employees grow and succeed. We believe that you have the skills and drive to make a real impact. We foster a thriving internal community and are committed to creating a workplace that looks like the world that we serve. Our Risk Management teams work to protect the safety and soundness of our systems and are responsible for identifying, managing, measuring and mitigating a spectrum of key risk types including credit, market, liquidity, systemic, operational and technology in all existing and new products, activities, processes and systems.

In this role, you will support the Cyber Security Due Diligence SME team within the Cyber Security Risk Office (CSRO), responsible for overseeing technology, cyber security, and operational resilience risk assessments across DTCC's third party ecosystem. Your work will directly contribute to strengthening DTCC's Third Party Risk Management program by ensuring effective identification, assessment, monitoring, and remediation of cyber and technology risks associated with vendors, service providers, and other external partners. You will work closely with Business, Technology, Legal, Sourcing, Resilience, and Risk Management stakeholders to perform due diligence assessments, third party onboarding activities, control gap remediation, onsite reviews, and specialized assessments, including fourth party risk, NYSDFS cybersecurity reviews, encryption key management, and software supply chain security. The role is also responsible for advancing third party cyber risk reviews, enhancing assessment methodologies, and supporting regulatory compliance.

Responsibilities

• Conduct technology, cyber security, operational resilience, and specialized risk assessments of third parties supporting DTCC's critical services
• Provide subject matter expertise on third-party cyber risk management, emerging regulatory requirements, and industry best practices, including NYSDFS Cybersecurity Regulation, operational resilience requirements, software supply chain risk, fourth-party risk, and encryption key management
• Partner closely with Sourcing, Legal, Enterprise Program Management, Architecture Review Board (ARB), Technology, Resilience, Security, and Business stakeholders to support third-party onboarding, contract reviews, and risk-based decision making
• Perform remediation efforts for identified third party control gaps and assessment findings, ensuring appropriate accountability, transparency, and timely risk reduction
• Build strong relationships with internal and external stakeholders. Partner with other internal stakeholders on third party risk activities. Participate in discussions with internal and external stakeholders to plan and execute on process enhancements
• Demonstrate effective written and verbal communication skills, active engagement in meetings and thought leadership. Provide guidance to internal stakeholders on processes and address issues and inquiries timely.
• Prioritize multiple tasks and initiatives. Lead the execution of Third Party Risk Management frameworks and manage project tasks effectively.
• Demonstrate and apply a thorough understanding of risk management processes and activities, with specific focus on key third party risks. Viewed as a subject matter expert. Aligns risk and control processes into day to day responsibilities to monitor and mitigate risk; escalates appropriately
• Ensure third-party cyber risk management activities support DTCC's overall risk ma

Qualifications

• Minimum of 6 years of related experience
• Bachelor's degree preferred or equivalent experience

Benefits

• Comprehensive health and life insurance and well-being benefits, based on location
• Pension / Retirement benefits
• Paid Time Off and Personal/F