Overview
The TPRM Analyst will play a crucial role within the Risk function, focusing on third-party risk management in a contract capacity. Working with various stakeholders including Risk, Compliance, and Procurement, the analyst will conduct supplier assessments, manage risk documentation, and ensure compliance with security protocols. This position provides an opportunity to leverage expertise in information security risk while contributing to the organization's risk management framework.
Responsibilities
- Conduct third-party and supplier risk assessments, including inherent and residual risk assessments.
- Complete supplier due diligence and review risk questionnaires covering security, privacy, financial, operational, and compliance risks.
- Review documentation including SOC 2 reports, ISO certifications, financial information, and disaster recovery plans.
- Identify, document, and track supplier risk findings and remediation actions.
- Support the onboarding and ongoing assessment of new and existing suppliers.
- Maintain supplier risk classifications and relevant TPRM records.
- Monitor supplier relationships through periodic reassessments and ongoing risk monitoring.
- Produce risk reporting and dashboards for management and governance forums.
Requirements
- 2+ years' experience in Third Party Risk Management, Supplier Assurance, or Information Security Risk.
- Hands-on experience conducting third-party/supplier risk assessments and due diligence.
- Understanding of information security, privacy, and operational risk.
- Familiarity with risk frameworks and standards such as NIST, ISO 27001, or SOC 2.
- Strong Excel skills for risk tracking and reporting.
- Experience using GRC or TPRM platforms like ServiceNow or OneTrust.
- Ability to produce risk management information using Excel and PowerPoint.
- Bachelor's degree in Business, Information Security, or a related field is advantageous.