Overview
Job Purpose
The Third-Party Risk Management (TPRM) Risk Analyst II is responsible for supporting the end-to-end lifecycle management of third-party relationships and serving as a key point of contact for vendor risk assessments, due diligence reviews, and onboarding activities. This role evaluates the risks associated with third-party engagements and ensures compliance with the organization's Third-Party Risk Management Program, policies, and regulatory requirements.
The Analyst II will collaborate with business stakeholders, control functions, and external vendors to facilitate risk assessments, identify control gaps, monitor remediation activities, and support ongoing vendor oversight. This role plays a critical part in protecting the organization from operational, compliance, information security, financial, and reputational risks arising from third-party relationships.
Responsibilities
- Third-Party Risk Assessments & Due Diligence
- Conduct risk assessments and due diligence reviews for new and existing third-party relationships in accordance with TPRM policies, procedures, and established timelines.
- Evaluate vendor controls, documentation, and risk factors across information security, operational resilience, compliance, financial, and business continuity domains.
- Identify risks, control gaps, and policy exceptions, and recommend appropriate mitigation strategies.
- Review supporting documentation including SOC reports, financial statements, business continuity plans, cybersecurity assessments, and regulatory compliance artifacts.
- Perform inherent risk analyses to determine assessment scope and due diligence requirements.
- Lifecycle Management
- Support vendor onboarding, ongoing monitoring, contract renewals, and termination activities throughout the vendor lifecycle.
- Partner with business relationship owners to ensure appropriate risk management activities are completed prior to vendor engagement and throughout the relationship.
- Track assessment findings, remediation plans, and exception management activities to completion.
- Monitor vendor performance and risk indicators and escalate emerging risks as appropriate.
- Stakeholder Engagement & Compliance
- Collaborate with business units, Legal, Procurement, Compliance, Information Security, Privacy, and Operational Risk teams to facilitate risk reviews and issue resolution.
- Provide guidance to stakeholders regarding TPRM requirements, processes, and regulatory expectations.
- Assist in maintaining compliance with applicable regulatory requirements and internal TPRM standards.
- Support internal and external audit examinations by gathering documentation, responding to inquiries, and tracking remediation efforts.
- Reporting & Program Support
- Maintain accurate and complete vendor records within TPRM systems and repositories.
- Perform data validation and quality assurance reviews to ensure the integrity of third-party risk information.
- Generate reports, metrics, and dashboards that provide visibility into assessment status, risk issues, remediation activities, and program performance.
- Assist with the continuous improvement of TPRM processes, procedures, templates, and governance practices.
- Support TPRM training and awareness initiatives across the organization.
- Other Responsibilities
- Serve as a primary contact for assigned business areas regarding third-party risk management activities.
- Participate in special projects and program initiatives as assigned.
- Occasional domestic travel may be required.
- Maintain a regular in-office presence in accordance with company policy.
Knowledge and Experience
- Bachelor's degree in Finance, Risk Management, Information Systems, Cybersecurity, or a related field.
- 3-5+ years of experience in Third-Party Risk Management, Vendor Risk Management, Operational Risk, Information Security Risk, Audit, Compliance, or a related risk discipline.
- Experience conducting risk assessments, due diligence reviews, and control evaluations.
- Working knowledge of third-party risk management frameworks, governance practices, and lifecycle management processes.
- Understanding of relevant regulatory guidance and industry standards, including OCC, FFIEC, FDIC, CFPB, NIST, COBIT, and COSO frameworks.
- Strong analytical, problem-solving, and organizational skills.
- Ability to manage multiple priorities and meet deadlines in a fast-paced environment.
- Excellent verbal and written communication skills with the ability to effectively communicate risk concepts to diverse audiences.
- Proficiency with Microsoft Office Suite, including Excel, Word, PowerPoint, and Outlook.
- Strong attention to detail and risk awareness.
- Ability to build collaborative relationships across all levels of the organization.
- Sound judgment and decision-making capabilities.
- Customer-focused mindset with a commitment to delivering high-quality service.
- Continuous improvement orientation and willingness to adapt to evolving regulatory and business requirements.
Preferred Knowledge and Experience
- Experience with TPRM platforms such as ProcessUnity, ServiceNow, Archer, OneTrust, or similar GRC tools.
- Exposure to financial services, exchanges, fintech, banking, or regulated industries.
- Professional certifications such as Certified Third-Party Risk Professional (CTPRP), Certified Risk and Vendor Management Professional (CRVPM), Certified Information Systems Auditor (CISA), or similar credentials.
- Experience supporting regulatory examinations, audits, or compliance reviews.
#LI-JM1
