Senior Third-Party Risk Management (TPRM) Analyst

Hybrid on site in Union Square. We are seeking a Senior Third-Party Risk Management (TPRM) Analyst with hands-on technical assessment expertise to evaluate and mitigate cybersecurity, regulatory, and operational risks across our third-party vendor ecosystem.

The ideal candidate is an experienced individual contributor who dives deep into technical vendor evidence-personally analyzing SOC reports, network architecture, penetration tests, and questionnaire responses to validate controls, identify deficiencies, and formulate actionable risk remediations.

• Hands-on Technical Due Diligence: Plan and execute end-to-end cybersecurity risk assessments for third-party vendors, suppliers, and SaaS/cloud providers.
• Evidence & Control Evaluation: Conduct line-by-line technical reviews of vendor documentation, including SOC 1 / SOC 2 Type II reports, SIG/CAIQ questionnaires, independent penetration tests, vulnerability scans, and architectural data-flow diagrams.
• Exception & Gap Management: Analyze audit exceptions and evaluate vendor management responses. Structure binding Corrective Action Plans (CAPs), establish formal 60-to-90 day remediation milestones, and define robust compensating controls when standard certifications are missing.
• Shared Responsibility & PCI Reviews: Review PCI Attestations of Compliance (AOC) and Reports on Compliance (ROC); verify scope alignment and identify Complementary User Entity Controls (CUECs) or shared responsibility requirements that fall on the internal organization.
• Continuous & Ongoing Monitoring: Leverage external security ratings and threat intelligence platforms to monitor supplier security posture in real time. Evaluate risk alerts, material changes, and security incidents to trigger targeted reassessments.
• Stakeholder & Business Partnership: Act as a pragmatic, trusted risk advisor to business units and procurement. Articulate technical risks in clear business terms, balance operational needs with security governance, and prepare executive risk summaries for leadership sign-off without unnecessarily stalling business initiatives.
• Platform Administration & Workflow Optimization: Manage vendor records, assessment lifecycles, and risk registers within enterprise GRC platforms, enhancing automation and assessment turnaround times.

• Experience: 5+ years of dedicated, hands-on experience in Third-Party Risk Management (TPRM), Vendor Risk Assessment (VRM), or Information Security Risk.
• Technical Depth: Proven ability to dissect SOC 2 Type II Section IV testing matrices, evaluate CUECs, review web/network penetration testing summaries, and interpret cloud security architectures (AWS/Azure).
• Framework Fluency: Strong working knowledge of industry standards and regulatory frameworks, including NIST CSF / 800-53, ISO/IEC 27001, SOC 2 Trust Services Criteria, PCI-DSS, GDPR, CCPA, and NYDFS Part 500. Exposure to critical infrastructure or energy standards (e.g., NERC CIP) is a strong plus.
• Tooling Proficiency: Direct experience working within enterprise GRC/TPRM platforms (e.g., OneTrust, ServiceNow GRC, RSA Archer, ProcessUnity) and continuous threat intelligence tools (e.g., BitSight, SecurityScorecard, Black Kite, RiskRecon).
• Certifications (Preferred): CISA, CRISC, CISSP, CTPRP, or ISO 27001 Lead Auditor.
• Education: Bachelor's degree in Cybersecurity, Information Systems, Computer Science, or a related field (or equivalent practical experience).