Specialist, Third Party Operations

Equiliem; New York (NY); Hybrid; USD 69,000 - 85,000; Full time

Job summary

Equiliem is seeking a Specialist in Third-Party Operations for Third-Party Risk Management to independently conduct risk assessments of vendors and monitor ongoing risk across the third-party lifecycle.

The role requires reviewing evidence, evaluating cybersecurity controls, and collaborating with Procurement, Legal, and Information Security to strengthen risk practices.

Qualifications

• Minimum 3 years of relevant professional experience independently conducting third-party risk assessments.
• Experience reviewing vendor documentation and evidence, evaluating controls, identifying deficiencies, and documenting assessment conclusions and recommendations.
• Working knowledge of cybersecurity risk management, data privacy, PII protection, and regulatory requirements (GDPR, CCPA, PCI).
• Experience reviewing SIG or comparable vendor risk questionnaires and validating responses against supporting documentation.

Responsibilities

• Independently conduct and complete third-party risk assessments, including reviewing evidence, evaluating controls, identifying deficiencies, and documenting risk ratings and recommendations.
• Evaluate vendor security controls when SOC 2 Type II reports or equivalent certifications are unavailable by reviewing security policies, ISO certifications, penetration testing results, and other independent evidence.
• Assess third-party risks related to cybersecurity, data privacy, PII, regulatory compliance, and PCI requirements.
• Review vendor security questionnaires, including SIG assessments, validate responses against supporting evidence, identify inconsistencies, and request clarification when needed.
• Use TPRM and GRC platforms to manage assessments, document findings, and track remediation activities.
• Conduct ongoing monitoring and periodic reassessments in response to security incidents, regulatory changes, financial concerns, ownership changes, and subcontractor changes.
• Evaluate control effectiveness and recommend remediation plans or other risk mitigation measures.
• Support third-party due diligence, risk assessment, approval, monitoring, and offboarding processes.
• Track and report risk metrics, including assessment timelines, outstanding high-risk findings, and remediation progress.
• Collaborate with Procurement, Legal, Information Security, Privacy, Risk Management, and business stakeholders to communicate assessment outcomes and support risk-based decisions.
• Evaluate relevant business and financial risks, including insurance-related considerations such as underwriting, claims, fraud, and financial exposure.
• Contribute to improvements in risk assessment procedures, monitoring practices, and the overall TPRM framework.

Skills

Risk assessment

Vendor management

Analytical thinking

Communication skills

Independent work

Education

Bachelor's degree in a related field

Tools

KY3P

Archer

ServiceNow

Aravo

Coupa

Mitratech/Prevalent

Job description

Specialist, Third-Party Operations – Third-Party Risk Management

Location:

New York, NY

Schedule/Shift:

8-hour workday; fully onsite for the first 30 days, then hybrid with a minimum of 3 days onsite per week

Pay:

$50-$62.50 per hour

Job Summary

The Third-Party Risk Management Specialist independently conducts vendor risk assessments to evaluate cybersecurity controls, data privacy practices, regulatory compliance, and potential business risks. This role reviews vendor documentation and security evidence, identifies control gaps, assigns risk ratings, and documents findings and recommendations to support informed business decisions. The specialist manages assessments throughout the third-party lifecycle, monitors remediation activities, and collaborates with Procurement, Legal, Information Security, Privacy, and other stakeholders to strengthen risk management practices.

Job Responsibilities

• Independently conduct and complete third-party risk assessments, including reviewing evidence, evaluating controls, identifying deficiencies, and documenting risk ratings and recommendations.
• Evaluate vendor security controls when SOC 2 Type II reports or equivalent certifications are unavailable by reviewing security policies, ISO certifications, penetration testing results, and other independent evidence.
• Assess third-party risks related to cybersecurity, data privacy, personally identifiable information (PII), regulatory compliance, and Payment Card Industry (PCI) requirements.
• Review vendor security questionnaires, including Standardized Information Gathering (SIG) assessments, validate responses against supporting evidence, identify inconsistencies, and request clarification when needed.
• Use third-party risk management (TPRM) and governance, risk, and compliance (GRC) platforms to manage assessments, document findings, and track remediation activities.
• Conduct ongoing monitoring and periodic reassessments in response to security incidents, regulatory changes, financial concerns, ownership changes, and subcontractor changes.
• Evaluate control effectiveness and recommend remediation plans or other risk mitigation measures.
• Support third-party due diligence, risk assessment, approval, monitoring, and offboarding processes.
• Track and report risk metrics, including assessment timelines, outstanding high-risk findings, and remediation progress.
• Collaborate with Procurement, Legal, Information Security, Privacy, Risk Management, and business stakeholders to communicate assessment outcomes and support risk-based decisions.
• Evaluate relevant business and financial risks, including insurance-related considerations such as underwriting, claims, fraud, and financial exposure.
• Contribute to improvements in risk assessment procedures, monitoring practices, and the overall TPRM framework.

Job Requirements

• Minimum 3 years of relevant professional experience, with demonstrated hands-on responsibility for independently conducting and completing third-party risk assessments.
• Experience reviewing vendor documentation and technical evidence, evaluating security controls, identifying deficiencies, and documenting assessment conclusions and recommendations.
• Working knowledge of cybersecurity risk management, data privacy, PII protection, and applicable regulatory requirements, including GDPR, CCPA, and PCI considerations.
• Experience reviewing SOC reports, ISO certifications, security policies, penetration testing results, and other vendor security evidence.
• Experience analyzing SIG or comparable vendor risk questionnaires and validating vendor responses against supporting documentation.
• Practical experience with enterprise TPRM or GRC platforms, such as KY3P, Archer, ServiceNow, Aravo, Coupa, or Mitratech/Prevalent.
• Understanding of continuous monitoring, ongoing monitoring, risk remediation, periodic reassessments, and third-party risk reporting.
• Strong analytical, critical-thinking, documentation, and communication skills.
• Ability to exercise sound risk judgment, work independently, and collaborate effectively with technical and business stakeholders.
• Bachelor's degree in a related field.

Preferred Qualifications

• Experience with KY3P or other enterprise third-party risk management platforms.
• Experience assessing vendors in regulated industries, particularly financial services or insurance.
• Familiarity with emerging third-party risks, including cybersecurity threats, geopolitical developments, and supply chain disruptions.
• Experience evaluating PCI compliance documentation, including Attestations of Compliance (AOCs) and Reports on Compliance (ROCs).
• Experience improving TPRM workflows, assessment processes, reporting, and risk monitoring practices.