Third Party Information Security Analyst

This role is located in New York City and requires a hybrid work schedule of at least 2 days in office per week. Officer-level candidates preferred.

About the Company

Sumitomo Mitsui Trust Bank, Limited was established through the merger of The Sumitomo Trust and Banking Co., Ltd with Chuo Mitsui Trust and Banking, Ltd. on April 1, 2012. We are one of the largest asset managers in Asia and number one among Japanese financial institutions by AUM, with approximately $850 billion USD in assets under management. The Bank provides an assortment of financial solutions and manages a broad spectrum of financial products across its global branches.

Department Overview

The Americas Division (“AD”) was established in the Sumitomo Mitsui Trust Bank, Limited, New York Branch (“SMTBNY”) to perform corporate functions and supervise U.S. entities. The division includes the Global Banking Unit (“GBU”) and Global Markets Unit (“GMU”), which perform business functions. Information Risk Governance (“IRG”) provides oversight to information and cyber security risk by maintaining and improving a branch-wide framework aligned with Head Office and regulatory requirements, addressing Confidentiality, Integrity, and Availability for information assets. IRG establishes appropriate policies, procedures, measurement, and monitoring processes to proactively assess and evaluate cyber security and information security risks inherent in branch operations. IRG is directly involved in all information and cyber security-related projects, matters, and issues.

About the Role

The Third Party Information Security Analyst supports the Bank’s Third Party Risk Management function by focusing on assessing and monitoring information security risks associated with 3rd, 4th, and Nth parties. This role assists with vendor due diligence, security reviews, information security risk assessments, and ongoing monitoring activities to ensure third-party relationships align with the organization’s security requirements.

Responsibilities

• Conduct initial and continuous information security risk assessments of third (Nth) parties.
• Review third-party provided security documentation including SOC reports, ISO 27001 certifications, security questionnaires, and Business Continuity and Disaster Recovery documentation.
• Document assessment findings and risk ratings in the Bank’s TPRM platform and maintain an up-to-date tracking sheet that provides management with clear visibility into the status, due date, and completion of each assessment and related follow-up actions.
• For vendor due-diligence, with a focus on information security risks, coordinate with relevant teams (Administration, Legal, etc.) for vendor onboarding and offboarding activities.
• Perform ongoing monitoring of information security-related incidents involving third-parties and coordinate with relevant stakeholders to facilitate requests for necessary information from the relevant third-parties and support the assessment of potential impact to the Bank.
• Participate in internal audits and external examinations related to the information security risk domains of third-party risk management.
• Assist in maintaining information security-related TPRM policies and procedures.
• Perform other duties and responsibilities as assigned by management.

Qualifications

• 3+ years of experience with risk assessment methodologies and techniques as well as the Third Party Risk Management Lifecycle.
• Prior experience with financial industry structure and concepts is a plus.
• Prior experience working on a Third Party Risk Management (TPRM) platform, such as Prevalent.
• Prior experience working with and assessing information security-related documentation such as SOC 2 reports, ISO 27001 certification, etc.
• Strong knowledge of information security and risk management frameworks, including NIST Cybersecurity Framework, ISO/IEC 27001, and the Cyber Risk Institute Profile.
• Strong Microsoft Office skills.
• Strong verbal and written communication skills.
• Strong analytical skills.
• Self-motivated with good time management skills.

Benefits

• Paid Time Off
• Medical, HSA, vision, and dental insurance
• FSA (Flexible Spending Account)
• 401(k) with profit sharing
• Legal plan
• Cancer indemnity plan
• Disability insurance
• Life insurance
• Employee assistance program
• Commuter benefits
• Business travel accident insurance
• Paid volunteer day
• Paid memberships and seminars
• Tuition assistance

We offer many socialization opportunities for wellness, financial wellbeing, runs/walks, team building, happy hours, and activities to support the Sustainable Development Goals.