Third Party Risk Analyst

Citizens Financial Group•Johnston, RI

2d•Hybrid

About The Position

The Third Party Risk Analyst manages vendor issues and executes third-party assessments. The role manages relationships with business leaders and vendors while providing robust, challenging insight into business risk and the adequacy and effectiveness of test control processes. The analyst reviews assessments and provides opinions on vendor control environments to help meet Citizens policies, identify issues, and assist the business in agreeing on action plans to mitigate risk. The Third-Party Assessment function provides business-function assurance regarding customer, financial, and reputational risks, builds momentum for risk-mitigation action plans, and applies findings and best practices across the bank. The analyst evaluates the effectiveness of third-party vendors’ control infrastructure and gathers control evidence. The role also supports governance, risk, and compliance program design and improvement; leads risk assessments and metrics; works with business leaders on risk analysis and management; monitors risk exceptions; supports regulatory examinations and remediation; and produces assessment reports for varied audiences. The ability to travel within the United States is required. The schedule is 40 hours per week, 8 a.m. to 5 p.m., with four days in the office and one day remote. The role is not eligible for new employer-sponsored or current H-1B visa holders. Applicants, including current OPT, L, and other visa holders, must be authorized to work in the United States without requiring new employer sponsorship for themselves or their spouses now or in the future.

Requirements

Ability to navigate program requirements independently.
Advanced critical-thinking skills.
Ability to identify opportunities and recommend solutions.
Ability to manage multiple assessments and related activities appropriately.
Strong verbal and written communication skills with internal and external stakeholders.
Strong analytical skills to identify and classify inherent and residual risks.
Ability to lead stakeholder calls to achieve desired results.
Experience in a financial services organization, particularly in Risk, Audit, Compliance, Cyber, or Third-Party Risk.
Proficiency with Microsoft Word and Microsoft Excel.
Experience gathering and analyzing evidence through methods such as email, virtual sessions, or onsite work, and from sources such as artifacts, interviews, meetings, demonstrations, independent audits, and reviews of processes or policies.
Must be authorized to work in the United States without the need for new employer sponsorship for themselves or their spouses now and in the future.

Nice To Haves

Bachelor’s degree.
Relevant industry certifications, such as CISA, CRCM, CRISC, CTPRP, or TPCRA.

Responsibilities

Evaluate third-party vendors’ control infrastructure effectiveness and obtain evidence of controls.
Apply knowledge of audit, security, and regulatory frameworks, including ISO 27001, GLBA, SOX, PCI, HIPPA, state privacy regulations, and FFIEC.
Assist with GRC program design, process reengineering or enhancements, and tool and technology implementations, as applicable.
Lead current and continual risk assessments and develop risk metrics and visualizations.
Work directly with business leaders to facilitate risk analysis and management, identify acceptable risk levels, and establish risk-management roles and responsibilities.
Maintain and monitor the enterprise risk exception process to identify areas of noncompliance.
Support and participate in regulatory examination preparation and execution, as well as remediation where applicable.
Produce third-party vendor assessment reports that clearly articulate risks to varied audiences.
Translate security risk and communicate effectively with business partners.
Manage vendor issues and relationships with business leaders and vendors; review assessments, identify issues, and assist the business in agreeing to appropriate risk-mitigation action plans.
Travel within the United States as required.