About the job
About the Role
The Third-Party Risk Assessor will collaborate with internal business units, cross-functional partners, and external vendor teams to evaluate end-to-end third-party risks. The role focuses on identifying vulnerabilities, assessing control environments, and establishing mitigation frameworks across multiple critical operational and regulatory risk domains.
Responsibilities
- Due Diligence & Screening
- Define, execute, and integrate risk domain screenings into vendor onboarding workflows and continuous monitoring plans.
- Risk Assessments & Audits
- Lead joint domain evaluations including scope definition, control testing, stakeholder interviews, evidence review, finding prioritization, and remediation tracking.
- Ongoing Vendor Governance
- Carry out periodic monitoring routines aligned with the inherent risk profile of third-party engagements.
- Offboarding & Exit Strategy
- Establish risk domain requirements for offboarding, contract terminations, and secure vendor offboarding activities.
- TPRM Tooling & Questionnaire Refinement
- Review and update domain-specific logic within Inherent Risk Questionnaires (IRQs) to ensure accurate initial risk tiering.
- Mitigation & Control Advisory
- Advise on targeted controls to remediate identified gaps and determine acceptable post-remediation residual risk levels.
- Standardization & Risk Scoring
- Establish qualitative risk-scoring criteria consistent with the overarching enterprise risk taxonomy and framework.
- Education & Capability Building
- Promote risk awareness, share best practices internally, and provide guidance to third-party vendors.
- Metrics & Reporting
- Monitor and report on key process indicators (KPIs) and control effectiveness metrics to support executive decision-making.
Qualifications
- Education / Credentials
- Bachelor’s degree or relevant professional certifications (e.g., CTPRP, CISA, CRISC, CISM, CIPP, CIPT).
Required Skills
- Domain Experience
- 3+ years in third-party risk management (TPRM), operational risk, internal/external audit, or enterprise risk governance.
- Framework Knowledge
- Strong command of risk assessment methodologies, internal control frameworks, and industry best practices.
- Regulated Environments
- Proven ability to navigate complex, highly regulated operating environments and matrix structures.
- Execution & Autonomy
- Strong self-management skills to prioritize deliverables, manage dynamic workloads, and drive initiatives independently.
- Stakeholder Management
- Excellent communication, analytical, and influencing capabilities with a track record of building cross-functional partnerships.
Preferred Skills
- Overview & Context
- This opportunity is with a leading, highly regulated global enterprise operating in a multi-stakeholder environment.
- The organization is expanding its centralized Third-Party Risk Management (TPRM) function to evaluate, mitigate, and govern external vendor risks across diverse domains including cybersecurity, data privacy, business continuity, regulatory compliance, and operational resilience.