Third-Party Cyber Risk Management Engineer II

What you'll do

• Execute third-party security assessments and reassessments using industry-recognized tools following defined standards.
• Manage the inventory of third parties to ensure all required risk assessments are completed.
• Reconcile third-party records across multiple systems to identify data gaps and ensure secure data sharing.
• Track third-party security issues by maintaining records, monitoring remediation status against SLAs, and escalating gaps.
• Implement configuration items for assessment tools, including inventory attributes, workflow steps, and reporting fields.
• Produce quarterly and executive-level reports on assessment metrics and issue management.
• Perform root-cause analysis on data quality issues or defects in third-party records and workflows.
• Explore AI and automation opportunities to streamline risk assessment workflows and reduce manual effort.

What we're looking for

• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or equivalent education or work experience.
• 1-2+ years of experience in cybersecurity, IT risk, or third-party/vendor risk management.
• Experience conducting risk or security assessments in a cybersecurity, IT risk, or vendor risk context.
• Working knowledge of cybersecurity and data-privacy regulations and standards such as NYDFS or NIST CSF.
• Familiarity with data security and third-party risk frameworks like ISO 27001, NIST, and CIS.
• Experience working with GRC, TPCRM, or workflow platforms like Archer or ServiceNow (preferred).
• Experience with data reconciliation, reporting, or dashboarding tools such as Excel, Power BI, or SQL (preferred).
• CompTIA Security+ or Cybersecurity Analyst+ certifications are highly desired; CISSP, CISM, CRISC, or CTPRP are encouraged.