Specialist, Third-Party Operations

Specialist, Third-Party Operations - Third-Party Risk Management

Location: New York, NY
Schedule/Shift: 8-hour workday; fully onsite for the first 30 days, then hybrid with a minimum of 3 days onsite per week
Pay: $50-$62.50 per hour
26-10725

Job Summary

The Third-Party Risk Management Specialist independently conducts vendor risk assessments to evaluate cybersecurity controls, data privacy practices, regulatory compliance, and potential business risks. This role reviews vendor documentation and security evidence, identifies control gaps, assigns risk ratings, and documents findings and recommendations to support informed business decisions. The specialist manages assessments throughout the third-party lifecycle, monitors remediation activities, and collaborates with Procurement, Legal, Information Security, Privacy, and other stakeholders to strengthen risk management practices.

Job Responsibilities

• Independently conduct and complete third-party risk assessments, including reviewing evidence, evaluating controls, identifying deficiencies, and documenting risk ratings and recommendations.
• Evaluate vendor security controls when SOC 2 Type II reports or equivalent certifications are unavailable by reviewing security policies, ISO certifications, penetration testing results, and other independent evidence.
• Assess third-party risks related to cybersecurity, data privacy, personally identifiable information (PII), regulatory compliance, and Payment Card Industry (PCI) requirements.
• Review vendor security questionnaires, including Standardized Information Gathering (SIG) assessments, validate responses against supporting evidence, identify inconsistencies, and request clarification when needed.
• Use third-party risk management (TPRM) and governance, risk, and compliance (GRC) platforms to manage assessments, document findings, and track remediation activities.
• Conduct ongoing monitoring and periodic reassessments in response to security incidents, regulatory changes, financial concerns, ownership changes, and subcontractor changes.
• Evaluate control effectiveness and recommend remediation plans or other risk mitigation measures.
• Support third-party due diligence, risk assessment, approval, monitoring, and offboarding processes.
• Track and report risk metrics, including assessment timelines, outstanding high-risk findings, and remediation progress.
• Collaborate with Procurement, Legal, Information Security, Privacy, Risk Management, and business stakeholders to communicate assessment outcomes and support risk-based decisions.
• Evaluate relevant business and financial risks, including insurance-related considerations such as underwriting, claims, fraud, and financial exposure.
• Contribute to improvements in risk assessment procedures, monitoring practices, and the overall TPRM framework.

Job Requirements

• Minimum 3 years of relevant professional experience, with demonstrated hands-on responsibility for independently conducting and completing third-party risk assessments.
• Experience reviewing vendor documentation and technical evidence, evaluating security controls, identifying deficiencies, and documenting assessment conclusions and recommendations.
• Working knowledge of cybersecurity risk management, data privacy, PII protection, and applicable regulatory requirements, including GDPR, CCPA, and PCI considerations.
• Experience reviewing SOC reports, ISO certifications, security policies, penetration testing results, and other vendor security evidence.
• Experience analyzing SIG or comparable vendor risk questionnaires and validating vendor responses against supporting documentation.
• Practical experience with enterprise TPRM or GRC platforms, such as KY3P, Archer, ServiceNow, Aravo, Coupa, or Mitratech/Prevalent.
• Understanding of continuous monitoring, ongoing monitoring, risk remediation, periodic reassessments, and third-party risk reporting.
• Strong analytical, critical-thinking, documentation, and communication skills.
• Ability to exercise sound risk judgment, work independently, and collaborate effectively with technical and business stakeholders.
• Bachelor's degree in a related field.

Preferred Qualifications

• Experience with KY3P or other enterprise third-party risk management platforms.
• Experience assessing vendors in regulated industries, particularly financial services or insurance.
• Familiarity with emerging third-party risks, including cybersecurity threats, geopolitical developments, and supply chain disruptions.
• Experience evaluating PCI compliance documentation, including Attestations of Compliance (AOCs) and Reports on Compliance (ROCs).
• Experience improving TPRM workflows, assessment processes, reporting, and risk monitoring practices.

About Equiliem

Equiliem believes in empowering success. It's our job to cultivate relationships that connect people and employers in a way that is inclusive, intelligent, and allows both to thrive.

Across the U.S., leading companies in healthcare, government, engineering, manufacturing, professional services, and energy rely on us for their workforce solutions. Our recruiting and HR services include contract and direct hire staffing, Payrolling/EOR, Independent Contractor Compliance, and Managed Services.

For almost 30 years, we've helped shape our industry. Today, we continue to research, ask questions, and continuously enhance the candidate journey and client experience.

Benefits

We offer a comprehensive benefits package to our employees, which includes:

• Medical Insurance
• Vision & Dental Insurance
• Life Insurance
• Matching 401(k)
• Commuter Benefits
• Employee Discounts & Rewards
• Payroll Payment Options

By applying, you are providing consent for Equiliem to engage with you via phone calls, AI-generated calls, AI-generated text messages, standard text messages, and/or emails to share job opportunities. Consistent with our Privacy Policy, information obtained will not be shared with third parties for marketing or promotional purposes. Message frequency may vary for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You may reply STOP to cancel or HELP for assistance.

Equiliem is an equal opportunity employer. We do not discriminate or allow discrimination based on race, color, religion, creed, sex, age, sexual orientation, gender identity, national origin, ancestry, citizenship, genetic information, registered domestic partner status, marital status, disability, status as a crime victim, protected veteran status, political affiliation, union membership, or any other characteristic protected by law. Equiliem will consider qualified applicants with criminal histories in a manner consistent with the requirements of applicable law. If you have visited our website in search of information on employment opportunities or to apply for a position, and you require an accommodation in using our website for a search or application, please contact our Employee Services Department at [emailprotected] or (732) 238-6050.