Analyst, Third Party Risk Management

Intercontinental Exchange Holdings, Inc.; Atlanta (GA); On-site; USD 80,000 - 120,000; Full time

Job summary

Intercontinental Exchange, Inc. seeks a Third-Party Risk Management Risk Analyst II to support the end-to-end lifecycle management of vendor relationships.

You will conduct risk assessments, due diligence, and onboarding activities, ensuring alignment with regulatory requirements and ICE’s TPRM program. Collaborating with Legal, Compliance, Procurement, IT, and business units, you will identify control gaps, track remediation, generate risk reports, and maintain vendor records.

Qualifications

• Bachelor's degree in Finance, Risk Management, Information Systems, Cybersecurity, or a related field.
• 3-5+ years of experience in Third-Party Risk Management, Vendor Risk Management, Operational Risk, Information Security Risk, Audit, Compliance, or a related risk discipline.
• Experience conducting risk assessments, due diligence reviews, and control evaluations.
• Working knowledge of third-party risk management frameworks, governance practices, and lifecycle management processes.
• Understanding of regulatory guidance and industry standards (OCC, FFIEC, FDIC, CFPB, NIST, COBIT, COSO).
• Excellent communication skills to convey risk concepts to diverse audiences.
• Proficiency with Microsoft Office Suite (Excel, Word, PowerPoint, Outlook).

Responsibilities

• Conduct third-party risk assessments and due diligence for new and existing relationships.
• Evaluate vendor controls across information security, operational resilience, compliance, financial, and business continuity domains.
• Identify risks, control gaps, and policy exceptions; recommend mitigation strategies.
• Review SOC reports, financial statements, continuity plans, cybersecurity assessments, and regulatory artifacts.
• Perform inherent risk analyses to determine assessment scope and requirements.
• Support onboarding, ongoing monitoring, renewals, and termination activities throughout the vendor lifecycle.
• Track findings, remediation plans, and exception management to completion.
• Collaborate with Legal, Procurement, Compliance, Information Security, Privacy, and Operational Risk teams; guide stakeholders on TPRM requirements.
• Generate reports, metrics, and dashboards on assessment status, risk issues, and program performance.
• Maintain vendor records in TPRM systems and support audits.
• Assist with continuous improvement of TPRM processes, templates, and governance.
• Other Responsibilities: primary contact for assigned business areas; participate in special projects; occasional domestic travel; maintain in-office presence.

Skills

Risk management

Vendor risk

Regulatory knowledge

Analytical skills

Communication

MS Office

Time management

Cross-functional collaboration

Education

Bachelor's degree

Tools

ProcessUnity

ServiceNow

Archer

OneTrust

Job description

Overview

Job Purpose

The Third-Party Risk Management (TPRM) Risk Analyst II is responsible for supporting the end-to-end lifecycle management of third-party relationships and serving as a key point of contact for vendor risk assessments, due diligence reviews, and onboarding activities. This role evaluates the risks associated with third-party engagements and ensures compliance with the organization's Third-Party Risk Management Program, policies, and regulatory requirements.

The Analyst II will collaborate with business stakeholders, control functions, and external vendors to facilitate risk assessments, identify control gaps, monitor remediation activities, and support ongoing vendor oversight. This role plays a critical part in protecting the organization from operational, compliance, information security, financial, and reputational risks arising from third-party relationships.

Responsibilities

• Third-Party Risk Assessments & Due Diligence
  • Conduct risk assessments and due diligence reviews for new and existing third-party relationships in accordance with TPRM policies, procedures, and established timelines.
  • Evaluate vendor controls, documentation, and risk factors across information security, operational resilience, compliance, financial, and business continuity domains.
  • Identify risks, control gaps, and policy exceptions, and recommend appropriate mitigation strategies.
  • Review supporting documentation including SOC reports, financial statements, business continuity plans, cybersecurity assessments, and regulatory compliance artifacts.
  • Perform inherent risk analyses to determine assessment scope and due diligence requirements.
• Lifecycle Management
  • Support vendor onboarding, ongoing monitoring, contract renewals, and termination activities throughout the vendor lifecycle.
  • Partner with business relationship owners to ensure appropriate risk management activities are completed prior to vendor engagement and throughout the relationship.
  • Track assessment findings, remediation plans, and exception management activities to completion.
  • Monitor vendor performance and risk indicators and elevate emerging risks as appropriate.
• Stakeholder Engagement & Compliance
  • Collaborate with business units, Legal, Procurement, Compliance, Information Security, Privacy, and Operational Risk teams to facilitate risk reviews and issue resolution.
  • Provide guidance to stakeholders regarding TPRM requirements, processes, and regulatory expectations.
  • Assist in maintaining compliance with applicable regulatory requirements and internal TPRM standards.
  • Support internal and external audit examinations by gathering documentation, responding to inquiries, and tracking remediation efforts.
• Reporting & Program Support
  • Maintain accurate and complete vendor records within TPRM systems and repositories.
  • Perform data validation and quality assurance reviews to ensure the integrity of third-party risk information.
  • Generate reports, metrics, and dashboards that provide visibility into assessment status, risk issues, remediation activities, and program performance.
  • Assist with the continuous improvement of TPRM processes, procedures, templates, and governance practices.
  • Support TPRM training and awareness initiatives across the organization.
• Other Responsibilities
  • Serve as a primary contact for assigned business areas regarding third-party risk management activities.
  • Participate in special projects and program initiatives as assigned.
  • Occasional domestic travel may be required.
  • Maintain a regular in-office presence in accordance with company policy.

Knowledge and Experience

• Bachelor's degree in Finance, Risk Management, Information Systems, Cybersecurity, or a related field.
• 3-5+ years of experience in Third-Party Risk Management, Vendor Risk Management, Operational Risk, Information Security Risk, Audit, Compliance, or a related risk discipline.
• Experience conducting risk assessments, due diligence reviews, and control evaluations.
• Working knowledge of third-party risk management frameworks, governance practices, and lifecycle management processes.
• Understanding of relevant regulatory guidance and industry standards, including OCC, FFIEC, FDIC, CFPB, NIST, COBIT, and COSO frameworks.
• Strong analytical, problem-solving, and organizational skills.
• Ability to manage multiple priorities and meet deadlines in a fast-paced environment.
• Excellent verbal and written communication skills with the ability to effectively communicate risk concepts to diverse audiences.
• Proficiency with Microsoft Office Suite, including Excel, Word, PowerPoint, and Outlook.
• Strong attention to detail and risk awareness.
• Ability to build collaborative relationships across all levels of the organization.
• Sound judgment and decision‑making capabilities.
• Customer‑focused mindset with a commitment to delivering high‑quality service.
• Continuous improvement orientation and willingness to adapt to evolving regulatory and business requirements.

Preferred Knowledge and Experience

• Experience with TPRM platforms such as ProcessUnity, ServiceNow, Archer, OneTrust, or similar GRC tools.
• Exposure to financial services, exchanges, fintech, banking, or regulated industries.
• Professional certifications such as Certified Third-Party Risk Professional (CTPRP), Certified Risk and Vendor Management Professional (CRVPM), Certified Information Systems Auditor (CISA), or similar credentials.
• Experience supporting regulatory examinations, audits, or compliance reviews.

Intercontinental Exchange, Inc. is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to legally protected characteristics.