Senior Third Party Risk Mgmt Consultant

About the role

This role is responsible for the ongoing oversight of critical third-party vendors, ensuring their risk posture remains aligned with the organization's risk appetite, internal policies, and regulatory expectations throughout the vendor lifecycle. The analyst leverages risk intelligence tooling (e.g., Supply Wisdom and Black Kite) to detect material changes in vendor risk, triage alerts, and drive timely remediation, escalation, and reporting.

Responsibilities

• Participate in ongoing monitoring of critical vendors, including periodic reassessments and trigger-based reviews.
• Monitor risk intelligence feeds (Supply Wisdom and Black Kite) daily, reviewing alerts across cyber, financial, operational, geopolitical, compliance, and reputational risk domains.
• Perform initial triage and severity validation of incoming alerts, investigating alert context, vendor history, and existing controls to determine whether escalation is warranted.
• Initiate and conduct targeted assessments based on defined cadence and triggers (e.g., breach disclosures, sanctions/adverse media hits, material CVE exposure, breach notifications).
• Track changes in vendor risk posture and maintain monitoring tiers mapped to inherent risk, data sensitivity, concentration risk, and business criticality.
• Perform comprehensive risk assessments and reassessments of third-party vendors using standardized frameworks and questionnaires (IRQ/DDQ).
• Evaluate vendor responses, supporting documentation, and control effectiveness across domains such as cybersecurity, data protection, operational resilience, and regulatory compliance in ProcessUnity.
• Conduct SOC report reviews for suppliers in accordance with the annual review cadence.
• Evaluate updated evidence to identify control improvements or deterioration, newly introduced risks, and persistent or systemic issues.
• Analyze vendor risk posture and identify potential gaps or areas of concern.
• Collaborate with internal subject matter experts (e.g., InfoSec, Privacy, Legal, Compliance, Business Continuity) to validate findings and determine risk impact.
• Document risk trend analysis and provide clear rationale for any changes in inherent or residual risk ratings.
• Escalate Critical and High alerts for Tier 1 and Tier 2 vendors within defined SLA timeframes, notifying the Relationship Manager, TPRM Assessment team, and applicable SMEs (e.g., InfoSec, CSIRT).
• Communicate identified issues with Relationship Managers, InfoSec, Privacy, Legal, Compliance, and Business Continuity, and log outcomes in ProcessUnity.
• Provide internal business support as well as supplier support throughout the reassessment process.
• Document assessment results, risk ratings, and recommendations in the TPRM platform (ProcessUnity).
• Produce monthly operational dashboards and status reports, and support quarterly executive reporting on top risks, identified findings, and SOC/compliance reviews.
• Maintain accurate, audit-ready records of monitoring activity, escalation records, and reassessment outcomes.

Required Qualifications

• Experience in third-party risk, vendor assessments, or IT risk management.
• Familiarity with risk and control frameworks (e.g., NIST, ISO 27001, SOC 2, SIG).
• Working knowledge of risk assessment methodologies and control validation across information security, privacy, business continuity, and compliance domains.
• Strong analytical, communication, and stakeholder management skills.
• Ability to manage multiple priorities and meet deadlines in a fast-paced environment.
• Detail-oriented with a focus on accuracy and completeness.

Key Competencies

• Risk-based judgment and the ability to interpret and prioritize risk signals.
• Sound decision-making under defined thresholds and escalation protocols.
• Collaboration and partnership across cross-functional risk stakeholders.
• Ownership, accountability, and the ability to produce measurable, actionable outputs.

Skills

• information security
• cybersecurity
• InfoSec
• analytical
• Detail-oriented
• Communication
• Communicate
• decision-making
• meet deadlines
• accountability
• Collaboration
• business continuity
• operational resilience
• partnership
• business support
• assessments
• CISSP
• CRISC
• Continuous Monitoring
• data protection
• Due Diligence
• geopolitical
• ISO 27001
• IT risk management
• financial
• NIST
• internal policies
• regulatory compliance
• compliance reviews
• reputational risk
• risk
• Risk Assessments
• risks
• risk assessment methodologies
• risk appetite
• stakeholder management skills
• vendor assessments
• vendor risk
• third-party risk
• tooling
• trend analysis
• triage
• initial triage

Pay

$65 - $70 per hour

Schedule

9am to 5pm