Third Party Risk Analyst

Addison Group; Chicago (IL); On-site; USD 70,000 - 90,000; Full time

Job summary

A leading risk management firm in Chicago is seeking a detail-oriented Third-Party Risk Analyst. This role involves reviewing client and vendor contracts for security and compliance, assessing vendor risks, and maintaining security policies aligned with regulations. The ideal candidate should have 2–4 years of experience in risk management or contract review, along with strong analytical and communication skills. Join us to contribute to our comprehensive risk management program.

Qualifications

• 2–4 years of experience in third-party risk, compliance, or legal contract review.
• Familiarity with regulatory frameworks like GDPR, HIPAA, and SOC 2.

Responsibilities

• Review client and vendor contracts for security and compliance.
• Assess risks from third-party vendors and ensure compliance.
• Maintain and update security policies to align with regulations and internal needs.

Skills

Contract review

Risk assessments

Policy governance

Analytical skills

Communication skills

Organizational skills

Education

Bachelor’s degree in information security or related field

Job description

Overview

We are seeking a detail-oriented and analytical Third-Party Risk Analyst to support our risk management program. This role is responsible for reviewing client contracts for security and compliance requirements, assessing vendor and third-party risks, and maintaining and updating internal security policies to align with regulatory and contractual obligations.

The ideal candidate has experience in contract review, risk assessments, and policy governance in a cybersecurity or compliance-focused environment.

Key Responsibilities

Contract Review

• Review client and vendor contracts, data protection agreements, and master service agreements for information security, privacy, and compliance terms.
• Identify and communicate gaps between client requirements and internal policies or capabilities.
• Collaborate with Legal, Sales, Procurement, and IT Security teams to align contract terms with organizational standards.

Third-Party Risk Management

• Assess third-party vendors for cybersecurity and compliance risks.
• Track and manage third-party security assessments, questionnaires, and audits.
• Ensure vendor compliance with applicable regulations, such as GDPR, CCPA, HIPAA, SOC 2, ISO 27001, etc.

Security Policy Management

• Maintain and update information security policies and procedures to reflect changes in laws, regulations, and business needs.
• Coordinate policy reviews with stakeholders across IT, Legal, HR, and Compliance departments.
• Ensure policies meet the requirements outlined in client contracts and external audits.
• Documentation & Reporting:
  • Document risk findings and decisions in risk registers or compliance platforms.
  • Prepare reports and dashboards to communicate contract review outcomes and vendor risk status to leadership.
  • Track remediation activities related to third-party risk or contractual gaps.

Qualifications

• Bachelor’s degree in information security, Risk Management, Business, Legal Studies, or a related field.
• 2–4 years of experience in third-party risk, compliance, legal contract review, or security governance.
• Familiarity with regulatory frameworks (e.g., GDPR, HIPAA, PCI-DSS, ISO 27001, SOC 2).
• Strong understanding of contract terms related to data privacy and cybersecurity.
• Excellent analytical, communication, and organizational skills.