TPRM Continuous Monitoring Analyst

TEKsystems•Berwyn, IL

6d•$60 - $64•Remote

About The Position

The TPRM Continuous Monitoring Analyst is responsible for the ongoing oversight of the client's critical third-party vendors, ensuring their risk posture remains aligned with the organization’s risk appetite, internal policies, and regulatory expectations throughout the vendor lifecycle. This role plays a key part in safeguarding the organization by conducting periodic reassessments, trigger-based reviews, and continuous monitoring of vendor controls across multiple risk domains -including information security, privacy, business continuity, operational resilience, and compliance. The analyst leverages risk intelligence tooling (e.g., Supply Wisdom and Black Kite) to detect material changes in vendor risk, triage alerts, and drive timely remediation, escalation, and reporting.

Requirements

Experience in third-party risk, vendor assessments, or IT risk management.
Familiarity with risk and control frameworks (e.g., NIST, ISO 27001, SOC 2, SIG).
Working knowledge of risk assessment methodologies and control validation across information security, privacy, business continuity, and compliance domains.
Strong analytical, communication, and stakeholder management skills.
Ability to manage multiple priorities and meet deadlines in a fast-paced environment.
Detail-oriented with a focus on accuracy and completeness.
Risk-based judgment and the ability to interpret and prioritize risk signals.
Sound decision-making under defined thresholds and escalation protocols.
Collaboration and partnership across cross-functional risk stakeholders.
Ownership, accountability, and the ability to produce measurable, actionable outputs.

Nice To Haves

third party risk management

Responsibilities

Participate in ongoing monitoring of critical vendors, including periodic reassessments and trigger-based reviews.
Monitor risk intelligence feeds (Supply Wisdom and Black Kite) daily, reviewing alerts across cyber, financial, operational, geopolitical, compliance, and reputational risk domains.
Perform initial triage and severity validation of incoming alerts, investigating alert context, vendor history, and existing controls to determine whether escalation is warranted.
Initiate and conduct targeted assessments based on defined cadence and triggers (e.g., breach disclosures, sanctions/adverse media hits, material CVE exposure, breach notifications).
Track changes in vendor risk posture and maintain monitoring tiers mapped to inherent risk, data sensitivity, concentration risk, and business criticality.
Perform comprehensive risk assessments and reassessments of third-party vendors using standardized frameworks and questionnaires (IRQ/DDQ).
Evaluate vendor responses, supporting documentation, and control effectiveness across domains such as cybersecurity, data protection, operational resilience, and regulatory compliance in ProcessUnity.
Conduct SOC report reviews for suppliers in accordance with the annual review cadence.
Evaluate updated evidence to identify control improvements or deterioration, newly introduced risks, and persistent or systemic issues.
Analyze vendor risk posture and identify potential gaps or areas of concern.
Collaborate with internal subject matter experts (e.g., InfoSec, Privacy, Legal, Compliance, Business Continuity) to validate findings and determine risk impact.
Document risk trend analysis and provide clear rationale for any changes in inherent or residual risk ratings.
Escalate Critical and High alerts for Tier 1 and Tier 2 vendors within defined SLA timeframes, notifying the Relationship Manager, TPRM Assessment team, and applicable SMEs (e.g., InfoSec, CSIRT).
Communicate identified issues with Relationship Managers, InfoSec, Privacy, Legal, Compliance, and Business Continuity, and log outcomes in ProcessUnity.
Provide internal business support as well as supplier support throughout the reassessment process.
Document assessment results, risk ratings, and recommendations in the TPRM platform (ProcessUnity).
Produce monthly operational dashboards and status reports, and support quarterly executive reporting on top risks, identified findings, and SOC/compliance reviews.
Maintain accurate, audit-ready records of monitoring activity, escalation records, and reassessment outcomes.