TC-CS-SRCR-Staff-Supply Chain and Third-Party Risk Management

Job Summary

The AI Third Party Risk Analyst is an entry-level role responsible for supporting the execution of Third-Party Security Assessments (TPSA) and Vendor Due Diligence processes. The analyst works within the Cyber Risk and Compliance team, applying foundational knowledge of third-party risk management (TPRM) frameworks, supply chain security principles, AI security for third parties and use of AI-enabled tools for Third Party Security Assessment. This role provides exposure to third party risk management lifecycle, onboarding assessment, and AI-assisted assessment & monitoring capabilities while building core competencies in cybersecurity, regulatory compliance, and data-driven risk evaluation.

Key Responsibilities

• Support end-to-end Third-Party Security Assessment (TPSA) activities including vendor intake, initial risk screening, assessor evaluation against industry specific standards/regulations and documentation of assessment findings.
• Assist in conducting vendor due diligence reviews by collecting, reviewing, and validating vendor-provided security evidence and questionnaire responses.
• Evaluate AI security practices of third parties wherever applicable.
• Participate in the risk assessment lifecycle from vendor onboarding through ongoing monitoring, escalation, and offboarding.
• Maintain and update TPRM risk registers, risk logs, and vendor risk profiles in GRC tools or risk management platforms.
• Support supply chain risk identification activities by flagging vendors with elevated exposure across IT, cloud, and operational domains.
• Assist senior team members in preparing risk assessment reports, dashboards, and executive summaries.
• Use and implement AI-enabled solutions for automated questionnaire/evidence analysis, gap identification, issue description and identification of risk treatment plans to accelerate risk evaluation.
• Track vendor remediation progress against identified control gaps and support follow-up activities.
• Maintain compliance with internal policies, regulatory standards (e.g., ISO 27001, NIST CSF, SOC 2 and more), and sector-specific requirements.
• Contribute to continuous improvement of TPRM workflows, templates, and assessment methodologies.

Education / Certifications

• Bachelor s degree in engineering, Technology, Business, Risk Management, or related discipline.
• Relevant certifications are advantageous (e.g., CompTIA Security+, ISO 27001 , ISO 42001, CISA, CISM, CISSP, other TPRM certifications).

AI & Cyber Certifications

Cyber Security Certifications (Required / Advantageous):

• CompTIA Security+ - Foundational cybersecurity knowledge covering threats, vulnerabilities, and risk management.
• ISO/IEC 27001 Foundation - Understanding of Information Security Management System (ISMS) principles.
• Certified in Risk and Information Systems Control (CRISC) - Entry-level awareness of IT/cyber risk concepts (pursuing).

AI & Data Certifications:

• Microsoft Azure AI Fundamentals (AI-900) - Foundational understanding of AI/ML concepts on cloud platforms.
• Google Cloud Digital Leader - Awareness of AI and cloud services applicable to risk assessment contexts.
• IBM AI Foundations for Business - Introduction to AI concepts including machine learning and automation.
• Coursera / edX AI for Everyone (Andrew Ng) - Broad awareness of AI applications in business and risk management.

Skills & Experience

Required Skills:

• 0-4 years of experience in cyber risk, third-party risk, information security, or related field.
• Basic understanding of Third-Party Risk Management (TPRM) frameworks and vendor assessment processes.
• Familiarity with risk assessment lifecycle stages: identification, evaluation, mitigation, monitoring, and reporting.
• Knowledge of cybersecurity standards such as ISO 27001, NIST CSF, SOC 2, and CIS Controls.
• Knowledge of AI governance standards as ISO 42001. Understanding of AI security, especially in context of third-party security.
• Understanding of supply chain risk concepts including vendor tiering and dependency mapping.
• Ability to review and validate vendor security questionnaires (e.g., SIG, CAIQ, custom questionnaires).
• Proficiency in MS Office tools (Excel, PowerPoint, Word) for risk tracking and reporting.
• Strong attention to detail, analytical thinking, and written communication skills.

Good to Have Skills (including AI):

• Exposure to GRC platforms (e.g., ServiceNow GRC, Archer, OneTrust, ProcessUnity) for risk tracking.
• Awareness of AI-enabled risk scoring tools and automated vendor intelligence platforms (e.g., BitSight, Security Scorecard, RiskRecon).
• Basic understanding of predictive modelling concepts applied to vendor risk prioritization.
• Familiarity with AI-driven questionnaire automation and NLP-based document analysis tools.
• Exposure to data analytics tools such as Excel Power Query, Power BI, or similar for risk dashboards.
• Interest in emerging AI technologies including machine learning applications in cyber risk management.
• Awareness of Graph AI concepts for mapping vendor relationships and supply chain dependencies.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.