Third-Party Risk Consultant

MassMutual•Springfield, MA

About The Position

The Third-Party Risk Consultant will implement the third-party technology risk framework and execute third-party risk assessments and due diligence across MassMutual’s third-party ecosystem. The role evaluates services, data flows, system integrations, controls, and evidence to identify and document risk exposure, while supporting adoption of risk management practices across the ETX organization. As part of the ETX Third-Party Technology Assurance team, the consultant collaborates with globally distributed Digital Trust, Governance & Technology Assurance teams and with business, technology, procurement, compliance, legal, enterprise risk, and audit partners in the U.S., Romania, and India. The role helps develop practical technology governance and risk management solutions that improve operational efficiency, transparency, and decision-making. The posting describes support for onboarding, knowledge transfer, documentation, and process adoption for a smooth contract engagement and potential transition to full-time employment.

Requirements

At least 2 years of experience in risk management and/or completing third-party risk assessments.
At least 2 years of experience implementing metrics to track status, identify trends, and surface potential issues.
At least 2 years of experience working in an enterprise GRC platform, including proficient use of Excel import/export functions.

Nice To Haves

Associate’s degree, preferably in technology, cybersecurity, risk management, or a business-related field.
At least 3 years of experience in third-party risk management, technology risk, cybersecurity, audit, or controls testing.
Foundational understanding of third-party risk domains, including cybersecurity and data protection, cloud/SaaS risk, identity and access management, and business continuity and resiliency.
Proficiency with SharePoint and related tools used to execute a regulatory compliance program.
Experience communicating regulatory requirements to technical and non-technical audiences and facilitating discussions among ETX owners, Compliance, and Law.
Familiarity with industry frameworks such as NIST, ISO 27001, and SOC 2, or similar.
Ability to interpret control evidence and assess its adequacy relative to risk.
Strong written and verbal communication skills and ability to work effectively with internal stakeholders, third parties, and globally distributed teams.
Experience in a contract, consulting, managed services, or globally distributed team environment, with ability to ramp quickly, document work clearly, and build trust with remote stakeholders across the U.S., Romania, and India.
Ability to execute with limited guidance and meet deadlines in a structured, process-driven environment.
Strong attention to detail and documentation discipline.

Responsibilities

Analyze third-party services, data flows, and system integrations to identify inherent and residual risk exposure.
Collaborate with issue management teams to ensure identified risks, including vulnerabilities, are tracked, communicated, and remediated.
Contribute to status reporting and metrics tracking for ongoing third-party risk activities.
Evaluate, document, communicate, and support breach event and incident response activities.
Execute risk evaluation procedures by reviewing evidence, documenting observations, and recording results using defined templates and quality standards.
Identify control gaps, weaknesses, or non-compliance issues and document findings for review and disposition.
Partner with senior practitioners to support risk rating determinations and escalation decisions.
Perform risk assessments to ensure third parties meet security and technology standards in alignment with established practices and procedures.
Escalate delays, information gaps, or emerging risks to the team lead.
Research and consult internal subject matter experts to understand and document risks identified through assessments and due diligence, and communicate findings to stakeholders.
Address requests, feedback, and comments from Digital Trust, Governance & Technology Assurance leadership, collaborating across Romania, U.S., and India working hours.
Support onboarding, knowledge transfer, documentation, and process adoption for a smooth contract engagement and potential transition to full-time employment.