TPRM Analyst

Integrity•Dallas, TX

About The Position

The Third-Party Risk Management Analyst runs the vendor due diligence program on the enterprise third-party risk platform. The organization engages thousands of suppliers, a substantial number of which have never been formally risk assessed, and the first mandate of this role is to reduce that population while establishing sustainable ongoing monitoring behind it. Third-party exposure is one of the highest-probability incident vectors in the industry, and vendors with access to enterprise systems or physical facilities all fall within scope. This role also serves as the first gate in the vendor intake process, assessing risk before the organization commits the limited resources of procurement, contracting, legal, and cybersecurity. The ideal candidate is detail-oriented, comfortable with assessment frameworks, and looking for a strong entry point into a growing enterprise risk function.

Requirements

Bachelor's degree in Business, Risk Management, Information Systems, Cybersecurity, or a related field
1 to 4 years of experience in third-party risk, vendor management, compliance, or security governance risk and compliance; internship experience will be considered
Familiarity with vendor assessment frameworks and security questionnaire methodologies
Understanding of how vendor access to systems, data, or facilities translates into organizational risk
Experience working to defined service level targets across a queue of concurrent requests
Strong analytical thinking and attention to detail, with accurate work across platforms and spreadsheets
Strong written and verbal communication, including direct interaction with external vendors
Organizational skills sufficient to manage a large assessment queue without items aging out
Ability to read a security report and identify what actually matters to the organization
Collaborative approach across procurement, legal, cybersecurity, and business unit stakeholders
Proficiency in Microsoft Office Suite, with strong Excel capability

Nice To Haves

Hands-on experience with a third-party risk platform such as Whistic, Archer, ServiceNow, or similar
Professional certification such as CTPRP, CRISC, or similar
Experience in insurance, financial services, or other regulated industries
Familiarity with System and Organization Controls 2 reports, NIST, ISO 27001, or HITRUST
Exposure to procurement or contract management systems
Experience supporting sanctions or denied-party screening processes

Responsibilities

Run vendor intake, inherent risk tiering, and due diligence assessment on the enterprise third-party risk platform
Reduce the backlog of suppliers that have not been formally risk assessed, working to an agreed prioritization based on access and criticality
Assess vendors with access to enterprise systems, data, or physical facilities, ensuring no in-scope category is omitted
Process vendor security questionnaires to closure within service level targets, coordinating with vendors and internal stakeholders to obtain required documentation
Partner with Cybersecurity on technical vendor reviews and with Contracting and Legal on risk-relevant terms
Serve as the first assessment gate in the vendor intake workflow so downstream functions engage only on vendors that clear
Support integration between the third-party risk platform and the procurement system to avoid duplicated effort across teams
Handle inbound due diligence requests and carrier annual audit responses through the trust center
Establish and execute ongoing monitoring and periodic reassessment based on vendor tier
Absorb the vendor population arriving through acquisitions and bring it into the assessment program
Feed third-party risk findings into the enterprise risk register and reporting
Maintain assessment documentation to an audit-ready standard suitable for control testing
Support sanctions and denied-party screening activity in coordination with Procurement, and support documentation of how flagged results are reviewed and resolved