Third Party Risk Management Consulting Director

CNA Insurance • Chicago, IL

2d • $97,000 - $189,000 • Hybrid

About The Position

At CNA, we strive to create a culture in which people know they matter and are part of something important, ensuring the abilities of all employees are used to their fullest potential. We are seeking a strategic thought leader to help drive forward our Third-Party Risk & Assurance function. In this role, you will play a critical part in strengthening and evolving our Third-Party Risk Management capabilities, driving consistency, transparency, and operational excellence across the organization. You will partner closely with Third Party risk peers and cross-functional stakeholders to enhance assurance practices, enable data-driven decision-making, and ensure the organization is well-positioned to manage third-party risk in an increasingly complex regulatory and technology landscape. The Third Party Risk Management program at CNA coordinates and performs risk management activities across cybersecurity, business continuity, compliance, and general operational risk controls throughout the lifecycle of the Third Party relationship. This individual contributor position manages program elements of the Third Party Risk Management program, including but not limited to, assessment methodology updates, assurance, performance and program level reporting and analytics.

Requirements

• Program expertise in Third Party Risk Management best-practices including industry security, business continuity, and data privacy standards, risk assessment testing procedures, issue management processes, and inherent/residual risk calculations
• Compelling communicator; demonstrated verbal and written communication skills.
• Detail oriented with strong organizational skills and ability to manage multiple projects effectively.
• Ability to communicate and simplify technical concepts for those not familiar with risk management concepts, particularly in the context of business stakeholder training.
• Strong interpersonal skills with the ability to work with staff at all levels.
• Proven thought leadership and ability to provide informal guidance to more junior team members.
• Strong knowledge of Microsoft Office Suite and other business-related software systems including processing systems and applications.
• Bachelor’s degree or equivalent
• Typically a minimum of nine years of experience in Supplier Risk or Third-Party Risk assessment
• Experience developing and managing remediation action/incident management processes.
• Experience in developing remediation action/incident management specific reporting and analytics.

Nice To Haves

• CISSP, CRISC, or CISA highly preferred

Responsibilities

• Perform Third Party Risk assessments for complex, sensitive, and escalated Third Party assessments, including those requiring on-site reviews.
• In the course of executing these critical and sensitive assessments, evaluate Third Party questionnaire responses, perform control review/validation, and assess documentation per established procedures and standards.
• Perform periodic quality assurance and review of Third Party Risk assessments performed by all assessment team members to ensure that all assessments meet established standards and expectations.
• Actively solicit business partner engagement and buy-in by attending, and organizing where appropriate, periodic meetings with business partners to ensure Third Party Risk Management is appropriately meeting business needs.
• Coordinate, review and submit program analytics to leadership covering process utilization metrics, program Key Performance Indicators, Third Party Risk Key Risk Indicators, and escalation reporting and management.
• Support leadership in managing and implementing all identified program, process, and technology configuration process improvements in the Third Party Risk Management program roadmap.
• Own the design, implementation, and ongoing management of the enterprise weighted third-party risk scorecard, ensuring risk calculations consistently incorporate assessment results, issue severity, remediation status, performance metrics (SLAs/KPIs), and monitoring signals to support prioritization, escalation, and executive decision-making.
• Develop and maintain interaction model with all relevant CNA Business and Risk Stakeholders.
• Ensure they are appropriately looped into TPRM processes and enabled to support TPRM through workflow, reporting, and analytics
• Leveraging general Third Party Risk Management expertise, take the lead on performing regular updates of CNA’s Third Party Risk Management methodologies
• Own enterprise-level governance, prioritization, and escalation of third-party issues to ensure remediation outcomes are risk-based, consistent, and defensible.
• Lead the support of TPRM Technology including the administration, management, configuration, and testing for all current TPRM technology.
• Additionally, monitor TPRM technology market landscape to ensure CNA's TPRM technology stack is appropriately updated.
• Develop and maintain a robust quality assurance program that extends outside of just individual auality control of assessments.
• May perform additional duties as assigned.

Benefits

• comprehensive and competitive benefits package to help our employees – and their family members – achieve their physical, financial, emotional and social wellbeing goals

What This Job Offers

• Job Type: Full-time
• Career Level: Director