Third-Party Risk Consultant

MassMutual; Springfield (MA); On-site; USD 110,000 - 140,000; Full time

Job summary

MassMutual is seeking a Third-Party Risk Consultant to implement the third-party tech risk framework and work with US, Romania, and India teams. You will conduct risk assessments, evaluate services, data flows, integrations, controls, and evidence to document risk exposure.

You’ll help adopt risk management practices across the ETX organization. You will collaborate across globally distributed teams, drive risk mitigation, and support a risk-aware culture with a focus on efficient governance and

Qualifications

• 2+ years of experience in risk management and/or completing third-party risk assessments.
• 2+ years of experience implementing metrics to track status, identify trends, and surface potential issues.
• 2+ years of experience working in an enterprise GRC platform, including proficient use of Excel import/export functions.
• Associate’s degree, preferably in technology, cybersecurity, risk management, or business-related field.
• Minimum of 3 years of experience in third-party risk management, technology risk, cybersecurity, audit, or controls testing.
• Foundational understanding of third-party risk domains, including cybersecurity, data protection, Cloud/SaaS risk, IAM, and business continuity.

Responsibilities

• Analyze third-party services, data flows, and system integrations to identify risk exposure.
• Collaborate with issue management teams to track and remediate vulnerabilities and risks.
• Support status reporting and metrics tracking for ongoing third-party risk activities.
• Evaluate and document evidence for breach events and incident response.
• Review and document observations to record results per templates and quality standards.
• Identify control gaps and non-compliance issues for review and disposition.
• Assist in risk rating determinations and escalation decisions.
• Perform risk assessments to ensure third parties meet security and technology standards.
• Escalate delays, gaps in information, or emerging risks to team lead.
• Consult with internal SMEs to document risk findings and communicate to stakeholders.
• Coordinate across Romania, U.S., and India working hours for timely responses.
• Assist onboarding, knowledge transfer, and documentation for contract engagement.

Skills

Risk management

Third-party risk assessments

Metrics & analytics

GRC platform

Excel

Education

Associate-degree (technology/cybersecurity/risk management/business)

Tools

Excel

SharePoint

Job description

Third-Party Risk Consultant

ETX Governance, Risk & Compliance Team

Full-Time, Springfield/Boston

The Opportunity

As a Third-Party Risk Consultant, you will play a crucial role in implementing the third-party technology risk framework while collaborating with U.S., Romania, and India-based Digital Trust, Governance & Technology Assurance teams. This position is responsible for executing third-party risk assessments and due diligence activities across MassMutual’s third-party ecosystem, including evaluating services, data flows, system integrations, controls, and evidence to identify and document risk exposure. Additionally, you will support the adoption of risk management practices across the ETX organization. As a key member of the ETX Third-Party Technology Assurance team, you will help drive change, collaborate effectively across global time zones, and enhance operational efficiency throughout the organization.

The Team

The Digital Trust, Governance & Technology Assurance Team is comprised of governance and risk professionals responsible for implementing governance processes and risk management practices for the ETX (Information Technology) organization. This role will operate as part of a globally distributed team and will work closely with U.S., Romania, and India-based business, technology, procurement, compliance, legal, enterprise risk, and audit partners to design practical and effective technology governance and risk management solutions that increase operational efficiency, improve transparency, and support informed decision-making.

The Impact

• Analyze third-party services, data flows, and system integrations to identify inherent and residual risk exposure
• Collaborate with issue management teams to ensure identified risks, including vulnerabilities, are appropriately tracked, communicated, and remediated
• Contribute to status reporting and metrics tracking for ongoing third-party risk activities
• Evaluate, document, communicate, and support breach event and incident response activities
• Execute risk evaluation procedures by reviewing evidence, documenting observations, and recording results in accordance with defined templates and quality standards
• Identify control gaps, weaknesses, or non-compliance issues and clearly document findings for further review and disposition
• Partner with senior practitioners to support risk rating determinations and escalation decisions
• Perform risk assessments to ensure third parties meet security and technology standards in alignment with established practices and procedures
• Proactively escalate delays, gaps in information, or emerging risks to the team lead
• Research and consult with internal subject matter experts to understand and document risk identified through risk assessments and due diligence practices, and communicate the findings to stakeholders
• Timely address asks, feedback, and comments provided by Digital Trust, Governance & Technology Assurance leadership, including collaboration across Romania, U.S., and India working hours
• Support onboarding, knowledge transfer, documentation, and process adoption activities needed to enable a smooth contract engagement and potential transition to full-time employment

The Minimum Qualifications

• 2+ years of experience in risk management and/or completing third-party risk assessments
• 2+ years of experience implementing metrics to track status, identify trends, and surface potential issues
• 2+ years of experience working in an enterprise GRC platform, including proficient use of Excel import/export functions

The Ideal Qualifications

• Associate’s degree, preferably in technology, cybersecurity, risk management, or business-related field
• Minimum of 3 years of experience in third-party risk management, technology risk, cybersecurity, audit, or controls testing
• Foundational understanding of third-party risk domains, including:
  • Cybersecurity and data protection
  • Cloud/SaaS risk considerations
  • Identity and access management (e.g., SSO vs. standalone access)
  • Business continuity and resiliency

• Proficiency with SharePoint and related tools used to execute an effective regulatory compliance program
• Experience communicating regulatory requirements to technical and non-technical audiences, and facilitating discussions between ETX owners, Compliance, and Law to ensure a shared understanding and effective compliance

• Familiarity with industry frameworks such as NIST, ISO 27001, SOC 2, or similar
• Ability to interpret control evidence and assess adequacy relative to risk
• Strong written and verbal communication skills, with the ability to interact effectively with internal stakeholders, third parties, and globally distributed teams
• Experience working in a contract, consulting, managed services, or globally distributed team environment, with demonstrated ability to ramp quickly, document work clearly, and build trust with remote stakeholders across multiple regions, including U.S., Romania, and India teams
• Demonstrated ability to execute with limited guidance while meeting deadlines in a structured, process-driven environment
• Strong attention to detail and documentation discipline

MassMutual is an equal employment opportunity employer. We welcome all persons to apply.

If you need an accommodation to complete the application process, please contact us and share the specifics of the assistance you need.

California residents: For detailed information about your rights under the California Consumer Privacy Act (CCPA), please visit our California Consumer Privacy Act Disclosures page.