Senior Third-Party Risk & Compliance Leader

Mistral; New York (NY); On-site; USD 140,000 - 190,000; Full time

Job summary

Mistral is seeking a Senior Third-Party Risk Specialist to identify, assess, and mitigate risks in vendor relationships. You will partner with Legal, Procurement, Security, and Ops to embed risk management into processes and governance.

You will lead due diligence, compliance reviews, and risk-based decision making, ensuring GDPR, NIS2, and DORA requirements are met across the organization while maintaining strong training and documentation practices.

Qualifications

• 7+ years in third-party risk management, cybersecurity compliance, information security governance, or a related field.
• Experience supporting cybersecurity compliance programs, certification processes, or external audits.
• Proficiency with standards and frameworks such as ISO 27001, SOC 2, NIST SP 800-53, or regulations like NIS2, DORA, GDPR.
• Risk assessment methodologies (e.g., EBIOS RM, ISO 27005).
• Familiarity with cybersecurity regulations such as NIS2, Cyber Resilience Act, LPM, or DORA.
• Strong organizational skills and attention to detail, with document coordination across teams.
• Excellent written and verbal communication skills.

Responsibilities

• Develop and manage the third-party risk management program: design, implement, and maintain a structured framework for identifying, assessing, and monitoring risks.
• Conduct third-party assessments and audits: due diligence, compliance assessments, security audits, and contract reviews to meet GDPR, NIS2, DORA obligations.
• Collaborate with internal teams: integrate third-party risk requirements into vendor selection and monitoring processes.
• Manage incidents and non-compliance: identify gaps and coordinate corrective actions until resolution.
• Raise awareness and train stakeholders: develop and deliver training on third-party risk issues.
• Maintain robust documentation: document assessments, decisions, and actions for audits.
• Monitor regulatory evolution: stay updated on changes and propose framework updates.
• Optimize tools and processes: improve tools and methodologies for program effectiveness.
• Align with resilience strategy: support cybersecurity and compliance objectives.
• Contract redlining and negotiation: review and negotiate terms to meet security requirements.

Skills

Third-party risk management

Cybersecurity compliance

Information security governance

Stakeholder coordination

Written and verbal communication

Risk assessment methodologies

English proficiency

Regulatory knowledge

Tools

Third-party risk management platforms

Job description

Mistral is seeking a Senior Third-Party Risk Specialist to identify, assess, and mitigate risks in vendor relationships. You will partner with Legal, Procurement, Security, and Ops to embed risk management into processes and governance.

You will lead due diligence, compliance reviews, and risk-based decision making, ensuring GDPR, NIS2, and DORA requirements are met across the organization while maintaining strong training and documentation practices.