Third-Party Cyber Risk Specialist

Cboe; Chicago (IL); On-site; USD 95,000 - 150,000; Full time

Job summary

Cboe is seeking a Third-Party Risk Management Specialist to help execute the risk management program for third-party vendors and service providers. The role focuses on cyber threats and vulnerabilities within the third-party ecosystem and requires coordinating with business, legal, technology, and information security teams to validate responses to client due diligence questionnaires.

The ideal candidate has 3+ years in third-party risk management or related fields, strong communication skills,

Qualifications

• 3+ years’ experience in third-party risk management, vendor management, security incident response, cyber management or comparable field.

Responsibilities

• Execute the risk management program for third-party vendors and service providers.
• Conduct third-party risk assessments and due diligence reviews.
• Coordinate with internal teams to validate questionnaire responses and fulfill client due diligence requests.
• Maintain a standardized library of responses for client due diligence questionnaires; ensure accuracy and consistency.
• Monitor vendor relationships and regulatory exams by obtaining documentation and drafting responses.

Skills

Vendor management

Third-party risk management

Security incident response

Cybersecurity knowledge

Education

Bachelor’s degree or equivalent in a relevant field

Tools

Response management software

Job description

• The GlobalThird-PartyRisk Management Team isseekingaThird-PartyRisk Management Specialist toassistin executing the risk management program for third-party vendors and service providers
• This position includes conducting comprehensive risk assessments, ensuring compliance with Cboe and industry security standards,monitoringvendor relationships,and addressing client due diligence inquiries to mitigate potential risks to the organization
• Cboe’sThirdPartyRiskManagement Specialist willspecifically focus on cyber threats and vulnerabilities within the third-party ecosystem
• Candidates must be able to quickly adjust to changing priorities and adapt to an evolving business environment
• Manage incoming client requests (such as assessments, questionnaires, etc.), prioritize and triage requests to appropriate teams, and validate non-disclosure agreements
• Facilitate communication between business, legal, technology, and information security teams to validate questionnaire responses and fulfill general requests related to controls defined by Cboe’s standards and policies
• Serve as a point of contact forinternal stakeholders forclientdue diligenceinquiries, ensuringtimelyandaccurateresponses
• Function as the subject matter expert for the response management software used for managing and responding precisely and quickly to client due diligence questionnaires
• Manage and maintain a standardized library of responses for client due diligence questionnaires, ensuring accuracy and consistency
• Collaborate with internal experts to update and refine responses as needed
• Assist team with onboarding new vendor relationships
• Collect, review, and process information and documentation from third partyvendors/suppliers
• Conduct third-party risk assessmentsand due diligence reviews.Analyzesecurity information toidentifysignificant control orsecurity gaps and report findings to senior team members
• Perform comprehensive security reviews of potential and existing third-party vendors using questionnaires and security tools to evaluate their cybersecurity controls andidentifypotential risks
• Analyze identified risks from third parties and prioritize them based on their potential impact and likelihood of occurrence; create remediation plans accordingly
• Continuouslymonitorthird-party vendors’ security posture through regular assessments, vulnerability scans, and incident reporting tomaintaina consistent level of security
• Coordinatewith internal security team to respond to cyber incidents involving third-party vendors, providing necessary support for investigation and remediation
• Assistwith regulatory exams by obtaining documentation and draftingresponsestoregulatorinquiries
• Performadditionalactivities as needed

Excellent communication and interpersonal skills, with the ability to collaborate effectively with cross-function teams3+ years’ experience in third-party risk management, vendor management, security incident response, cyber managementor comparable fieldrequiredExperience conducting vendor risk assessmentsExperience with third party/vendor risk managementplatforms isa plusBachelor’sDegree orequivalent work experiencein a relevant fieldAbility to work independently and manage multiple assignments/projects simultaneouslyStrong understanding of cybersecurity principles, including application security, access control, and incident response. Knowledge of compliance and regulatory frameworks (e.g., NIST, SOC 2, GDPR, ISO 27001)