Senior Third-Party Risk Management (TPRM) Analyst

Overview

Partnering with Aquent, a leading organization dedicated to securing critical infrastructure is seeking a dedicated security professional to play a pivotal role in safeguarding their digital ecosystem. In this impactful position, you will serve as the frontline defender against third-party vulnerabilities, directly influencing the security posture of an enterprise that millions rely on daily. By diving deep into technical evidence and collaborating with key business partners, your insights will actively mitigate risks, secure supply chains, and enable safe business innovation.

The Opportunity

In this dynamic role, you will go beyond high-level checklists to perform deep, hands-on technical due diligence across a diverse vendor ecosystem. You will collaborate closely with internal business units and procurement partners, translating complex technical risks into clear, actionable business terms. Your expertise will shape robust remediation strategies, ensuring that external partners meet rigorous security, regulatory, and operational standards without slowing down organizational momentum.

Key Responsibilities

• Execute end-to-end cybersecurity risk assessments for third-party vendors, suppliers, and SaaS/cloud providers.
• Conduct detailed, line-by-line technical reviews of vendor documentation, including SOC 1 / SOC 2 Type II reports, SIG/CAIQ questionnaires, independent penetration tests, vulnerability scans, and architectural data-flow diagrams.
• Analyze audit exceptions, evaluate vendor management responses, and structure binding Corrective Action Plans (CAPs) with formal 60-to-90 day remediation milestones.
• Review PCI Attestations of Compliance (AOC) and Reports on Compliance (ROC), verifying scope alignment and identifying Complementary User Entity Controls (CUECs) or shared responsibility requirements.
• Leverage external security ratings and threat intelligence platforms to monitor supplier security posture in real time, evaluating risk alerts and security incidents to trigger targeted reassessments.
• Act as a pragmatic, trusted risk advisor to business units and procurement, balancing operational needs with security governance and preparing executive risk summaries for leadership.
• Manage vendor records, assessment lifecycles, and risk registers within enterprise GRC platforms to enhance automation and turnaround times.

Required Qualifications

• 5+ years of dedicated, hands-on experience in Third-Party Risk Management (TPRM), Vendor Risk Assessment (VRM), or Information Security Risk.
• Proven technical depth to dissect SOC 2 Type II Section IV testing matrices, evaluate CUECs, review web/network penetration testing summaries, and interpret cloud security architectures (AWS/Azure).
• Strong working knowledge of industry standards and regulatory frameworks, including NIST CSF / 800-53, ISO/IEC 27001, SOC 2 Trust Services Criteria, PCI-DSS, GDPR, CCPA, and NYDFS Part 500.
• Direct experience working within enterprise GRC/TPRM platforms (such as OneTrust, ServiceNow GRC, RSA Archer, or ProcessUnity) and continuous threat intelligence tools (such as BitSight, SecurityScorecard, Black Kite, or RiskRecon).
• Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, or a related field (or equivalent practical experience).

Preferred Qualifications

• Professional certifications such as CISA, CRISC, CISSP, CTPRP, or ISO 27001 Lead Auditor.
• Exposure to critical infrastructure or energy sector standards (such as NERC CIP).