Our client, Energy Utilities company, specializing in renewable energy production, is actively seeking an accomplished Third-Party Risk Security Analyst.
______________________________________________
Note: THIS IS A HYBRID ROLE & ONLY W2 CANDIDATES (NO C2C/1099)
*** Candidate must be authorized to work in USA without requiring sponsorship ***
Position: Third-Party Risk Security Analyst (Job Id – 26-01210)
Location: New York NY 10003 (HYBRID 3 Days Onsite/2 Days Remote)
Duration: 3 months + Strong Possibility of Extension
______________________________________________________________________
- We’re seeking an experienced Senior Third-Party Risk Management (TPRM) Analyst to independently conduct and complete third-party risk assessments.
- This role is responsible for evaluating vendor security controls, analyzing supporting documentation, identifying potential risks and control gaps, and documenting findings and recommendations to support informed risk decisions.
- The ideal candidate will have hands-on experience managing TPRM assessments from initial review through documented conclusions, a strong understanding of cybersecurity, data privacy, and regulatory compliance, and practical experience using enterprise TPRM platforms, including KY3P. This is a technical risk management role requiring direct assessment ownership, not primarily supplier onboarding, administrative coordination, or documentation management.
- Independently conduct and complete third-party risk assessments, evaluating vendor risk, reviewing supporting evidence, identifying control gaps, and documenting risk ratings, findings, and recommendations.
- Evaluate vendor security controls and alternative evidence when SOC 2 Type II or equivalent certifications are unavailable, including security policies, ISO certifications, penetration testing results, and other independent assessments.
- Assess third-party risks related to cybersecurity, data privacy, personally identifiable information (PII), applicable regulatory requirements, and Payment Card Industry (PCI) compliance.
- Review and analyze vendor security questionnaires, including Standardized Information Gathering (SIG) assessments, validate responses against supporting documentation, identify inconsistencies, and obtain clarification or additional evidence when needed.
- Use third-party risk management and governance, risk, and compliance (GRC) platforms to manage assessments, document findings, track remediation activities, and support effective risk workflows. Experience with KY3P is particularly relevant.
- Conduct ongoing risk monitoring and reassessments when material changes occur, including security incidents, regulatory changes, financial concerns, ownership changes, or changes involving subcontractors.
- Evaluate the effectiveness of vendor risk controls and recommend appropriate remediation or risk mitigation measures based on assessment findings.
- Contribute to the effectiveness of the TPRM framework across the vendor lifecycle, including due diligence, risk assessment, approval, monitoring, and offboarding.
- Track and report risk metrics, including assessment completion timelines, outstanding high-risk findings, and remediation progress.
- Collaborate with Procurement, Legal, Information Security, Privacy, Risk Management, and business stakeholders to communicate assessment results and support risk-based decisions.
- Apply an understanding of business and financial risk, including insurance-related considerations such as underwriting, claims, fraud, and financial exposure, where applicable.
Experience/Qualifications
- Demonstrated hands-on experience independently conducting, analyzing, and completing third-party risk assessments as a primary job responsibility.
- Experience reviewing vendor documentation and technical evidence, evaluating the effectiveness of security controls, identifying risks and deficiencies, and documenting assessment conclusions and recommendations.
- Working knowledge of cybersecurity risk management, data privacy, PII protection, and relevant regulatory and compliance requirements, including GDPR/CCPA and PCI considerations.
- Experience reviewing SOC reports, ISO certifications, security policies, penetration testing results, and other evidence used to evaluate vendor risk.
- Experience analyzing SIG or comparable vendor risk questionnaires and validating vendor-provided responses against supporting documentation.
- Practical experience with enterprise TPRM or GRC platforms, including KY3P, Archer, ServiceNow, Aravo, Coupa, or Mitratech/Prevalent.
- Understanding of ongoing and continuous monitoring, risk remediation, periodic reassessments, and third-party risk reporting and metrics.
- Strong analytical, critical-thinking, documentation, and communication skills, including the ability to explain risk findings and recommend appropriate next steps.
- Ability to work independently, exercise sound risk judgment, and collaborate effectively with technical and business stakeholders.
_________________________________________________________
I'd love to talk to you if you think this position is right up your alley, and assure a prompt communication, whichever direction. If you're looking for rewarding employment and a company that puts its employees first, we'd like to work with you.
Bhupesh Khurana
Lead Technical Recruiter
Amerit Consulting is an extremely fast-growing staffing and consulting firm. Amerit Consulting was founded in 2002 to provide consulting, temporary staffing, direct hire, and payrolling services to Fortune 500 companies nationally; as well as small to mid-sized organizations on a local & regional level. Currently, Amerit has over 2,000 employees in 47 states. We develop and implement solutions that help our clients operate more efficiently, deliver greater customer satisfaction, and see a positive impact on their bottom line. We create value by bringing together the right people to achieve results. Our clients and employees say they choose to work with Amerit because of how we work with them - with service that exceeds their expectations and a personal commitment to their success. Our deep expertise in human capital management has fueled our expansion into direct hire placements, temporary staffing, contract placements, and additional staffing and consulting services that propel our clients’ businesses forward.
Amerit Consulting provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.
This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.
Applicants, with criminal histories, are considered in a manner that is consistent with local, state and federal laws.
