Sr Vendor Risk Management Analyst

Thomson Reuters; Virginia, Richmond (MN, VA); Hybrid; USD 88,000 - 164,000; Full time

Job summary

An established industry player is seeking a Senior Vendor Risk Management Analyst to enhance vendor risk processes. In this pivotal role, you'll assess and mitigate risks associated with third-party providers, ensuring alignment with business goals. You'll collaborate with internal teams and vendors to implement effective risk management strategies. This position offers a hybrid work model, competitive benefits, and opportunities for career development. Join a dynamic team that values inclusion and innovation, and make a meaningful impact in the realm of vendor risk management.

Benefits

Flexible Work Arrangements

Mental Health Days

Tuition Reimbursement

Employee Assistance Program

Commuter Benefits

Fitness Reimbursement

Retirement Savings Plan

Access to Headspace App

Paid Volunteer Days

Flexible Spending Accounts

Qualifications

• 5-7+ years in vendor risk management or related fields.
• Experience with frameworks like NIST, ISO, SIG.

Responsibilities

• Conduct risk assessments and evaluate vendor security practices.
• Develop policies for vendor risk management.

Skills

Vendor Risk Management

Risk Assessment

Vendor Assessment Methodologies

Contract Review

Communication Skills

Education

Bachelor's Degree

Industry Certifications (CTPRP, CRISC, CISA)

Tools

Risk Assessment Tools

Job description

Are you ready to join a team that helps Thomson Reuters, a global leader in providing trusted news, information, and software solutions, make informed decisions about the vendors and third-party providers that power our business? We are looking for a Senior Vendor Risk Management Analyst to join our global team in Richmond, VA, to help continue current vendor risk processes while working to improve the way we handle incoming and ongoing assessments.

In this role, you will play a critical role in assessing, monitoring, and mitigating the risks associated with our vendors and third-party providers. You will be responsible for conducting in-depth risk assessments, analyzing vendor performance, and developing strategic recommendations to ensure our vendor relationships align with our business goals and risk tolerance. You will work closely with stakeholders across the organization to identify, assess, and mitigate potential risks, and collaborate with vendors to implement risk mitigation plans and monitor their effectiveness.

About the Role

In this opportunity as Senior Vendor Risk Management Analyst, you will:

1. Vendor Risk Assessment: Conduct thorough risk assessments of vendors to evaluate their security practices and identify potential vulnerabilities.
2. Due Diligence: Perform due diligence on new and existing vendors to ensure they meet security requirements and comply with relevant regulations and standards.
3. Monitoring and Reporting: Continuously monitor vendor security performance and report findings to management. Maintain metrics and dashboards for tracking vendor risk.
4. Policy and Procedure Development: Develop and maintain policies and procedures related to vendor risk management, ensuring they align with industry best practices and organizational standards.
5. Collaboration: Work closely with internal teams, such as procurement, legal, and security, to integrate vendor risk management processes across the organization.
6. Contract Review: Assist in the review of vendor contracts to ensure appropriate security clauses and requirements are included.
7. Incident Response: Participate in incident response activities related to vendor security breaches, including investigation and remediation efforts.
8. Continuous Improvement: Identify opportunities for improving vendor risk management processes and implement changes to enhance overall security posture.
9. Vendor Compliance: Ensure that vendor management practices comply with industry standards, such as SOC, ISO, or PCI-DSS.
10. Vendor Risk Management: Analyze security findings from risk assessments and ensure they are logged and tracked appropriately in the Enterprise Risk Management tooling.

About You

You're a fit for the role of Senior Vendor Risk Management Analyst if your background includes:

1. 5-7+ years of experience in vendor risk management, third-party risk, or related fields
2. Experience with vendor assessment methodologies and frameworks (e.g., NIST, ISO, SIG)
3. Experience with vendor risk assessment tools and databases
4. Contract review and negotiation experience
5. Strong communication skills for interacting with vendors and internal stakeholders
6. Industry certifications such as CTPRP, CRISC, or CISA are considered a plus but are not required for this position

#LI-LP2

What's in it For You?

• Hybrid Work Model: We've adopted a flexible hybrid working environment (2-3 days a week in the office depending on the role) for our office-based roles while delivering a seamless experience that is digitally and physically connected.
• Flexibility & Work-Life Balance: Flex My Way is a set of supportive workplace policies designed to help manage personal and professional responsibilities, whether caring for family, giving back to the community, or finding time to refresh and reset. This builds upon our flexible work arrangements, including work from anywhere for up to 8 weeks per year, empowering employees to achieve a better work-life balance.
• Career Development and Growth: By fostering a culture of continuous learning and skill development, we prepare our talent to tackle tomorrow's challenges and deliver real-world solutions. Our Grow My Way programming and skills-first approach ensures you have the tools and knowledge to grow, lead, and thrive in an AI-enabled future.
• Industry Competitive Benefits: We offer comprehensive benefit plans to include flexible vacation, two company-wide Mental Health Days off, access to the Headspace app, retirement savings, tuition reimbursement, employee incentive programs, and resources for mental, physical, and financial wellbeing.
• Culture: Globally recognized, award-winning reputation for inclusion and belonging, flexibility, work-life balance, and more. We live by our values: Obsess over our Customers, Compete to Win, Challenge (Y)our Thinking, Act Fast / Learn Fast, and Stronger Together.
• Social Impact: Make an impact in your community with our Social Impact Institute. We offer employees two paid volunteer days off annually and opportunities to get involved with pro-bono consulting projects and ESG initiatives.
• Making a Real-World Impact: We are one of the few companies globally that helps its customers pursue justice, truth, and transparency. Together, with the professionals and institutions we serve, we help uphold the rule of law, turn the wheels of commerce, catch bad actors, report the facts, and provide trusted, unbiased information to people all over the world.

In the United States, Thomson Reuters offers a comprehensive benefits package to our employees. Our benefit package includes market competitive health, dental, vision, disability, and life insurance programs, as well as a competitive 401k plan with company match. In addition, Thomson Reuters offers market leading work life benefits with competitive vacation, sick and safe paid time off, paid holidays (including two company mental health days off), parental leave, sabbatical leave. These benefits meet or exceed the requirements of paid time off in accordance with any applicable state or municipal laws. Finally, Thomson Reuters offers the following additional benefits: optional hospital, accident and sickness insurance paid 100% by the employee; optional life and AD&D insurance paid 100% by the employee; Flexible Spending and Health Savings Accounts; fitness reimbursement; access to Employee Assistance Program; Group Legal Identity Theft Protection benefit paid 100% by employee; access to 529 Plan; commuter benefits; Adoption & Surrogacy Assistance; Tuition Reimbursement; and access to Employee Stock Purchase Plan. Thomson Reuters complies with local laws that require upfront disclosure of the expected pay range for a position. The base compensation range varies across locations.
For any eligible US locations, unless otherwise noted, the base compensation range for this role is $88,200 - $163,800.
This role may also be eligible for an Annual Bonus based on a combination of enterprise and individual performance.
Base pay is positioned within the range based on several factors including an individual's knowledge, skills and experience with consideration given to internal equity. Base pay is one part of a comprehensive Total Reward program which also includes flexible and supportive benefits and other wellbeing programs.

About Us

Thomson Reuters informs the way forward by bringing together the trusted content and technology that people and organizations need to make the right decisions. We serve professionals across legal, tax, accounting, compliance, government, and media. Our products combine highly specialized software and insights to empower professionals with the data, intelligence, and solutions needed to make informed decisions, and to help institutions in their pursuit of justice, truth, and transparency. Reuters, part of Thomson Reuters, is a world leading provider of trusted journalism and news.

We are powered by the talents of 26,000 employees across more than 70 countries, where everyone has a chance to contribute and grow professionally in flexible work environments. At a time when objectivity, accuracy, fairness, and transparency are under attack, we consider it our duty to pursue them. Sound exciting? Join us and help shape the industries that move society forward.

As a global business, we rely on the unique backgrounds, perspectives, and experiences of all employees to deliver on our business goals. To ensure we can do that, we seek talented, qualified employees in all our operations around the world regardless of race, color, sex/gender, including pregnancy, gender identity and expression, national origin, religion, sexual orientation, disability, age, marital status, citizen status, veteran status, or any other protected classification under applicable law. Thomson Reuters is proud to be an Equal Employment Opportunity Employer providing a drug-free workplace.

We also make reasonable accommodations for qualified individuals with disabilities and for sincerely held religious beliefs in accordance with applicable law. More information on requesting an accommodation here.

Learn more on how to protect yourself from fraudulent job postings here.

More information about Thomson Reuters can be found on thomsonreuters.com.