Third Party Risk Management (TPRM) Analyst

We need to output HTML fragment with sections: About the Team, About the Role, Responsibilities, Qualifications (maybe split into Minimum and Preferred?), Benefits, Pay, Schedule? The posting includes schedule info: "shifting from a hybrid work model to a fully in-person schedule up to 5 days a week." That's schedule info. Also benefits: described in Benefits paragraph. Pay: compensation range. So we need sections for those if they have real content. We must not repeat job title as heading. No Job ID. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions. Also remove "About USDS TikTok USDS Joint Venture LLC ..."? That's about the company, maybe we keep as "About the Team"? Actually "About the Team" already present. The "About USDS TikTok USDS Joint Venture LLC" is more about company; could be considered "About the Team"? But we already have About the Team section describing USDS Security - Risk & Compliance team. The later paragraph about USDS Joint Venture is about the company overall; maybe we can include as "About the Team" or maybe a separate "About the Company"? Not required; we can keep as part of About the Team or maybe drop if redundant. The instruction: "Prefer a few substantive sections over many thin ones." So we can combine. We need to preserve ALL substantive information; do not invent or summarize away detail. So we must keep details like responsibilities list, qualifications, benefits, pay, schedule. We must not include sections with filler like "commensurate with experience". Not present. We need to use

for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. However we should only include headings when posting has real specific content. The posting has "About the Team" and "About the Role". Those are not exactly the prescribed headings but we can map: "About the Team" maybe as "About the role"? Actually "About the Team" is about team, not role. But we can still use heading "About the Team"? The instruction says use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It gives examples but not strict list; we can use those headings if appropriate. We have "About the Team" and "About the Role". Could we change "About the Team" to "About the role"? Might lose info. Better to keep "About the Team" as heading? The instruction says use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It implies we should use those exact headings when applicable. But we have "About the Team" and "About the Role". Could we treat "About the Team" as "About the role"? Not accurate. Maybe we can keep "About the Team" as heading but it's not in the list; risk of violating instruction. However instruction says "use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." The "e.g." suggests examples, not exhaustive. So we can use other headings as long as they are

. Probably acceptable. We must not repeat job title as heading. No job title present in text. We must not put Job ID/requisition numbers as headings. We must remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. There's a line about Reasonable Accommodation with link; that's likely legal/EEO boilerplate; we should remove it. Also the "For Los Angeles County (unincorporated) Candidates:" paragraph is legal; remove. Also the "Job Information 【For Pay Transparency】Compensation Description (Annually)" we keep as Pay section. The benefits paragraph we keep as Benefits. The schedule info we keep as Schedule. We need to preserve all substantive information: So we need to keep the description of USDS Security - Risk & Compliance team, core service offerings, role description, responsibilities list, qualifications (minimum and preferred), benefits, pay, schedule, and maybe the "Why Join Us" and "Diversity & Inclusion" sections? Those are likely boilerplate/EEO? They are motivational but could be considered substantive? The instruction says remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate. "Why Join Us" and "Diversity & Inclusion" might be considered boilerplate but they are not legal; they are company culture. Might be okay to keep? However they are somewhat generic; but they are substantive? The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." So we should keep them unless they are considered boilerplate. The examples of boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning. "Why Join Us" and "Diversity & Inclusion" are not those. So we should keep them. But we need to decide sections: Could have About the Team, About the Role, Responsibilities, Qualifications, Benefits, Pay, Schedule, Why Join Us, Diversity & Inclusion. However we might combine Why Join Us and Diversity & Inclusion into a single "About Us" or keep separate. The instruction: prefer a few substantive sections over many thin ones. So maybe combine Why Join Us and Diversity & Inclusion into a single section like "About Us" or "Company Culture". But we have no heading for that in examples. Could use "About the Company". But we already have About the Team and About the Role. Might be okay to keep them as separate sections but that increases count. Let's see: we have About the Team, About the Role, Responsibilities, Qualifications, Benefits, Pay, Schedule, Why Join Us, Diversity & Inclusion. That's 9 sections. Might be okay but instruction says prefer few over many thin ones. Some sections may be thin: Why Join Us is a paragraph; Diversity & Inclusion is a paragraph. Could combine them into "Company Culture". That would reduce. We also have "About USDS TikTok USDS Joint Venture LLC" paragraph describing mission; could be part of About the Team or Company Culture. Let's structure:

About the Team

with paragraph about USDS Security - Risk & Compliance team, core service offerings, role within TPRM.

About the Role

with paragraph describing role.

Responsibilities

with

• list.

  Qualifications

  with maybe two sub-sections? Could keep as
  • for Minimum and Preferred? But we need to preserve detail. Could use

    inside? Not allowed? Only headings specified are

    . We could use

    with bold? But we must not invent headings. Could keep as

    with text: "Minimum Qualifications - ..." and "Preferred Qualifications - ..." as paragraphs.

    Benefits

    with paragraph describing benefits.

    Pay

    with paragraph about compensation range.

    Schedule

    with paragraph about fully in-person schedule up to 5 days a week.

    Company Culture

    combining Why Join Us and Diversity & Inclusion paragraphs. We must ensure we don't include any boilerplate like Reasonable Accommodation, Los Angeles County paragraph, etc. Check for duplicated lines: The responsibilities list includes some duplicated? Not seeing. Now produce HTML fragment. Let's extract exact text. About the Team paragraph: "The USDS Security - Risk & Compliance team is responsible for managing USDS security compliance in accordance with US compliance requirements and objectives, and providing industry leading governance, risk, and compliance services. The core service offerings include: Compliance & Security Risk Management, Controls & Compliance Framework, Security Compliance Policies, Charters, & Protocols, Vendor Program & Third-Party Risk Management, Governance, Risk, & Compliance (GRC) Platform, and Security & Compliance Behavior & Culture. This role is within the Third Party Risk Management vertical." We need to keep that. About the Role paragraph: "As a Third Party Risk Management (TPRM) analyst, you will be a subject matter expert and liaison between USDS and the lines of business as it pertains to vendor compliance screening, issues and vulnerability management, and cross-functional security and privacy control assurance. You will be responsible for owning and managing daily operations of assigned vendor compliance assessment coordination, technical writing, and USDS Vendor Lifecycle management. Within this role, you will closely coordinate with USDS Procurement and Legal teams to ensure USDS Vendor Program and Procurement Policies requirements are implemented, enforced and communicated to business owners, program managers and other other applicable internal teams." Note there is a typo "other other". We keep as is. Responsibilities list: - Coordinating between USDS TPRM, Procurement, and Legal operations about vendor lifecycle management, contract clauses verification and compliance assessment procedures - Technical writing and communication between cross-functional teams and Non-USDS lines of business - Validating vendor compliance screening assessments - Reporting vendor security risk assessments for authorized and rejected vendors - Coordinating between USDS Risk Management, Global Security Organization, and other applicable internal teams on unresolved findings and vulnerability management - Enhancing USDS TPRM standard operating procedure as it pertains to emerging threats and USDS Vendor Program policy requirements - Validating security standard controls and audits as applicable to the overall USDS TPRM program and process - Managing assessment lifecycles and dashboard reporting - Coordinating and executing assessments for site visit assessments (physical and remote) and reporting related to TikTok USDS data centers and Content Delivery Networks (CDNs) We need to keep each as
  • . Qualifications: Minimum Qualifications: - Bachelor’s degree in risk management or equivalent privacy, security, compliance, project management, or like discipline from an accredited college - 3+ years of third party risk management or related privacy/security experience - Technical writing and verbal communication skills that enable executive reporting on Third Party Risk metrics - Findings and vulnerability management experience related to the resolution and/or remediation of web vulnerabilities, bugs, and cybersecurity vulnerabilities - Critical thinking and analytical decision making skills to forecast issues, events and/or risks pertaining to TPRM Preferred Qualifications: - Supply Chain risk management experience related to software and hardware solutions/tooling to include but not limited to Bill of Materials (BOM) analysis - Contract clause verification pertaining to security, privacy and business resilience controls - Experience implementing vendor lifecycle procedures including Onboarding, Ongoing Monitoring and Offboarding requirements - Experience with TPRM incident event management, policy development, enhancement and awareness - Experience with OFAC Sanctions and foreign ownership compliance assessments We need to preserve these exactly. Benefits paragraph: "Employees have day one access to medical, dental, and vision insurance, a 401(k) savings plan with company match, paid parental leave, short-term and long-term disability coverage, life insurance, wellbeing benefits, among others. Employees also receive 10 paid holidays per year, 10 paid sick days per year and 17 days of Paid Personal Time (prorated upon hire with increasing accruals by tenure). The Company reserves the right to modify or change these benefits programs at any time, with or without notice." We should keep that. Pay paragraph: "The base salary range for this position in the selected city is $98800 - $196000 annually. Compensation may vary outside of this range depending on a number of factors, including a candidate’s qualifications, skills, competencies and experience, and location. Base pay is one part of the Total Package that is provided to compensate and recognize employees for their work, and this role may be eligible for additional discretionary bonuses/incentives, and restricted stock units." We keep. Schedule paragraph: "As such, the company is shifting from a hybrid work model to a fully in-person schedule up to 5 days a