Third Party Risk Assessment Analyst

Atomic Recruitment SEA; Selangor; On-site; MYR 60,000 - 90,000; Full time

Job summary

Atomic Recruitment SEA is seeking a Third-Party Risk Assessor in Malaysia to collaborate with internal and external teams to evaluate third-party risks across regulatory domains. You will define risk domain screenings, lead domain evaluations, and establish mitigation frameworks, while monitoring control effectiveness and reporting KPIs to support leadership decisions.

Qualifications include a bachelor’s degree and professional certifications in risk management, with 3+ years in TPRM or related

Qualifications

• 3+ years in third-party risk management (TPRM), operational risk, internal/external audit, or enterprise risk governance.
• Strong command of risk assessment methodologies and control frameworks.
• Experience navigating regulated environments and matrix structures.

Responsibilities

• Define, execute, and integrate risk domain screenings into vendor onboarding workflows and continuous monitoring plans.
• Lead joint domain evaluations including scope definition, control testing, stakeholder interviews, evidence review, finding prioritization, and remediation tracking.
• Carry out periodic monitoring routines aligned with the inherent risk profile of third-party engagements.
• Establish risk domain requirements for offboarding, contract terminations, and secure vendor offboarding activities.
• Review and update domain-specific logic within IRQs to ensure accurate initial risk tiering.
• Advise on targeted controls to remediate identified gaps and determine acceptable post-remediation residual risk levels.
• Establish qualitative risk-scoring criteria consistent with the enterprise risk taxonomy and framework.
• Education & Capability Building; Promote risk awareness and share best practices with third-party vendors.
• Monitor and report on KPIs and control effectiveness metrics to support executive decision-making.

Skills

Domain Experience

TPRM Experience

Framework Knowledge

Regulated Environments

Execution Autonomy

Stakeholder Management

Education

Bachelor’s degree

Certifications

Job description

The Third-Party Risk Assessor will collaborate with internal business units, cross-functional partners, and external vendor teams to evaluate end-to-end third-party risks. The role focuses on identifying vulnerabilities, assessing control environments, and establishing mitigation frameworks across multiple critical operational and regulatory risk domains.

Responsibilities

• Define, execute, and integrate risk domain screenings into vendor onboarding workflows and continuous monitoring plans.


• Lead joint domain evaluations including scope definition, control testing, stakeholder interviews, evidence review, finding prioritization, and remediation tracking.


• Carry out periodic monitoring routines aligned with the inherent risk profile of third-party engagements.


• Establish risk domain requirements for offboarding, contract terminations, and secure vendor offboarding activities.


• Review and update domain-specific logic within Inherent Risk Questionnaires (IRQs) to ensure accurate initial risk tiering.


• Advise on targeted controls to remediate identified gaps and determine acceptable post-remediation residual risk levels.


• Establish qualitative risk-scoring criteria consistent with the overarching enterprise risk taxonomy and framework.


• Education & Capability Building


• Promote risk awareness, share best practices internally, and provide guidance to third-party vendors.


• Metrics & Reporting


• Monitor and report on key process indicators (KPIs) and control effectiveness metrics to support executive decision-making.

Qualifications

• Education / Credentials


• Bachelor’s degree or relevant professional certifications (e.g., CTPRP, CISA, CRISC, CISM, CIPP, CIPT).

Required Skills

• Domain Experience


• 3+ years in third-party risk management (TPRM), operational risk, internal/external audit, or enterprise risk governance.


• Framework Knowledge


• Strong command of risk assessment methodologies, internal control frameworks, and industry best practices.


• Regulated Environments


• Proven ability to navigate complex, highly regulated operating environments and matrix structures.


• Execution & Autonomy


• Strong self-management skills to prioritize deliverables, manage dynamic workloads, and drive initiatives independently.


• Stakeholder Management


• Excellent communication, analytical, and influencing capabilities with a track record of building cross-functional partnerships.

Preferred Skills

• Overview & Context


• This opportunity is with a leading, highly regulated global enterprise operating in a multi-stakeholder environment.


• The organization is expanding its centralized Third-Party Risk Management (TPRM) function to evaluate, mitigate, and govern external vendor risks across diverse domains including cybersecurity, data privacy, business continuity, regulatory compliance, and operational resilience.