Risk & Compliance Analyst II - Third-Party Risk Management

• Education:Bachelor's degree in a related field.
• Years of Experience: Minimum four (4) years of experience in Internal Audit (IT Audit preferred), IT Risk, or Information Security.
• Knowledge of project management skills (task identification, prioritization, and documentation).
• Demonstrated ability to effectively balance multiple responsibilities which may frequently change.
• Ability to learn information quickly and apply risk/control considerations which impact downstream decisions.
• Ability to interface effectively with internal and external auditors.
  
• Critical thinking skills with strong attention to detail and follow up.
  
• High degree of professionalism and personal integrity.
  
•  Ability to work with a high degree of independence.
  
• Excellent documentation skills (process, control, policy, and risk documentation).
  
• Excellent verbal and written communication skills across all levels of personnel (through executive management and the Board of Directors).
  
• Knowledge of and experience with performing ongoing risk analysis to determine what customer services, supporting business processes, systems, components and applications need to be recovered and within what time frame in order to comply with recovery time objectives.
  
• Familiarity with internet, networking (LAN and WAN), data and voice telecommunications, and cloud computing in order to assist in the preparation of recovery procedures in these areas.
  
• Good knowledge of Industry "Best Practices" such as ISO 27001, PCI-DSS.
  
• Good knowledge of TCP/IP and related protocols.
  
• Familiarity with intrusion detection and prevention techniques.
  Ability to conduct research into security issues and products as required.
• Familiarity of standard risk management/control frameworks such as COBIT, ISO 27005, COSO, NIST 80030, and ITIL.
• Understanding of internal audit and risk-based methodologies.
  
• Sarbanes-Oxley (SOX) experience.
  
• Understanding and experience with NIST and PCI standards.
  
• Strong experience in any of the following areas: IT Audit, IT Risk and/or Information Security.
  
• Demonstrate proficiency in assessing risk and risk management practices.
  
• Possesses knowledge of IT policies, standards and procedures, security frameworks and their development and implementation.

• Preferred Industry certifications include CTPRP, CTPRA, CRISC, CISSP, or a comparable credential in risk management, auditing, privacy, or information security.
• Familiarity with either GRC (Governance, risk management, and compliance) or IRC (Integrated Risk Management) applications.
• Required hands-on experience with OneTrust Third-Party Risk Management, including third-party intake, assessment workflows, questionnaires, issues, remediation tracking, reporting, and ongoing monitoring.
• Solid understanding of end-to-end third-party risk management processes, including intake and scoping, inherent risk assessment, due diligence, control assessment, residual risk determination, risk treatment, ongoing monitoring, reassessment, and offboarding.
• Demonstrated ability to identify and evaluate third-party risks and controls across information security, privacy, access management, vulnerability management, incident management, business continuity/disaster recovery, regulatory compliance, and data protection.
• Experience documenting control gaps, risk findings, compensating controls, residual risk, remediation plans, and formal risk acceptance decisions.
• Understanding of risk treatment options, including mitigation, remediation, transfer, avoidance, and acceptance, and the ability to recommend treatment based on risk severity and business context.
• Ability to lead multiple concurrent third-party assessments and coordinate deliverables with vendors, business owners, Information Security, Privacy, Legal, Procurement, and other stakeholders.
• Strong analytical and critical-thinking skills, with the ability to review vendor evidence and determine whether controls are appropriately designed and implemented.
• Excellent documentation skills, including concise and defensible risk narratives, assessment conclusions, issue statements, action plans, and executive-level reporting.
• Excellent verbal and written communication skills across technical and nontechnical audiences, including leadership and external vendors.
• Ability to work independently, prioritize changing demands, follow up on open issues, and drive risk treatment activities to completion.
• Knowledge of relevant frameworks and standards such as NIST, ISO 27001, PCI DSS, SOC 2, COBIT, and applicable privacy requirements.
• Experience with IT risk, information security, internal audit, procurement, vendor management, or compliance programs.
• Industry certification such as CTPRP, CTPRA, CRISC, CISA, CISSP, or a comparable risk/security credential is preferred.
• Sarbanes-Oxley (SOX), PCI-DSS experience.
• Understanding and experience with NIST and PCI-DSS.
• Strong experience in any of the following areas: IT Audit, IT Risk and/or Information Security.
• Demonstrate proficiency in assessing risk and risk management practices.
• Possesses knowledge of IT policies, standards and procedures, security frameworks and their development and implementation.

Job Duties

Physical Requirements 

Essential Services Provider