TC-CS-SRCR-Staff-Supply Chain and Third-Party

About the Role

The AI Third Party Risk Analyst is an entry-level role responsible for supporting the execution of Third-Party Security Assessments (TPSA) and Vendor Due Diligence processes. The analyst works within the Cyber Risk and Compliance team, applying foundational knowledge of third-party risk management (TPRM) frameworks, supply chain security principles, AI security for third parties and use of AI-enabled tools for Third Party Security Assessment. This role provides exposure to third party risk management lifecycle, onboarding assessment, and AI-assisted assessment & monitoring capabilities while building core competencies in cybersecurity, regulatory compliance, and data-driven risk evaluation.

Key Responsibilities

• Support end-to-end Third-Party Security Assessment (TPSA) activities including vendor intake, initial risk screening, assessor evaluation against industry specific standards/regulations and documentation of assessment findings.
• Assist in conducting vendor due diligence reviews by collecting, reviewing, and validating vendor-provided security evidence and questionnaire responses.
• Evaluate AI security practices of third parties wherever applicable.
• Participate in the risk assessment lifecycle from vendor onboarding through ongoing monitoring, escalation, and offboarding.
• Maintain and update TPRM risk registers, risk logs, and vendor risk profiles in GRC tools or risk management platforms.
• Support supply chain risk identification activities by flagging vendors with elevated exposure across IT, cloud, and operational domains.
• Assist senior team members in preparing risk assessment reports, dashboards, and executive summaries.
• Use and implement AI-enabled solutions for automated questionnaire/evidence analysis, gap identification, issue description and identification of risk treatment plans to accelerate risk evaluation.
• Track vendor remediation progress against identified control gaps and support follow-up activities.
• Maintain compliance with internal policies, regulatory standards (e.g., ISO 27001, NIST CSF, SOC 2) and sector-specific requirements.
• Contribute to continuous improvement of TPRM workflows, templates, and assessment methodologies.

Requirements & Tech Stack

• Bachelor’s degree in engineering, Technology, Business, Risk Management, or related discipline.
• Required Skills:
• 0–4 years of experience in cyber risk, third-party risk, information security, or related field.
• Basic understanding of Third-Party Risk Management (TPRM) frameworks and vendor assessment processes.
• Familiarity with risk assessment lifecycle stages: identification, evaluation, mitigation, monitoring, and reporting.
• Knowledge of cybersecurity standards such as ISO 27001, NIST CSF, SOC 2, and CIS Controls.
• Knowledge of AI governance standards as ISO 42001.
• Understanding of AI security, especially in context of third-party security.
• Understanding of supply chain risk concepts including vendor tiering and dependency mapping.
• Ability to review and validate vendor security questionnaires (e.g., SIG, CAIQ, custom questionnaires).
• Proficiency in MS Office tools (Excel, PowerPoint, Word) for risk tracking and reporting.
• Strong attention to detail, analytical thinking, and written communication skills.
• Advantageous Certifications:
• CompTIA Security+
• ISO 27001 Foundation
• CRISC (entry-level awareness)
• Microsoft Azure AI Fundamentals (AI-900)
• Google Cloud Digital Leader
• IBM AI Foundations for Business
• Coursera / edX AI for Everyone
• Good to Have Skills:
• Exposure to GRC platforms (e.g., ServiceNow GRC, Archer, OneTrust, ProcessUnity) for risk tracking.
• Awareness of AI-enabled risk scoring tools and automated vendor intelligence platforms (e.g., BitSight, Security Scorecard, RiskRecon).
• Basic understanding of predictive modelling concepts applied to vendor risk prioritization.
• Familiarity with AI-driven questionnaire automation and NLP-based document analysis tools.
• Exposure to data analytics tools such as Excel Power Query, Power BI, or similar for risk dashboards.
• Interest in emerging AI technologies including machine learning applications in cyber risk management.
• Awareness of Graph AI concepts for mapping vendor relationships and supply chain dependencies.
• AI Tools Skillset:
• Vendor Risk & Scoring Tools: BitSight / Security Scorecard / RiskRecon – Awareness and basic navigation for vendor cyber ratings and continuous monitoring signals.
• GRC Tools: Familiarity with vendor risk management workflow tools for questionnaire tracking and risk registers.
• GRC & Automation Platforms: ServiceNow GRC – Basic usage for risk logging, vendor profiles, and assessment task management. Microsoft Power Automate – Introductory exposure to workflow automation for risk data collection and notifications.
• Data Analytics & Reporting: Microsoft Excel (Power Query, Pivot Tables) – Risk data aggregation, vendor scoring worksheets, and basic dashboard creation. Microsoft Power BI – Consuming pre-built risk dashboards and understanding risk KPIs.
• AI Awareness Tools: ChatGPT / Microsoft Copilot – Basic use for summarizing vendor documentation, drafting risk findings, and accelerating report writing. Bing AI / Google Gemini – Research assistance for vendor background checks and regulatory lookups.

Qualifications

• Bachelor’s degree in engineering, Technology, Business, Risk Management, or related discipline.
• Relevant certifications are advantageous (e.g., CompTIA Security+, ISO 27001, ISO 42001, CISA, CISM, CISSP, other TPRM certifications).

Behavioral Expectations

• Deliver assigned modules with quality and timeliness.
• Collaborate effectively across teams and stakeholders.
• Demonstrate learning agility in AI and cyber risk domains.
• Support continuous improvement and automation initiatives.
• Show curiosity and proactively develop skills in AI-enabled risk management.
• Maintain professionalism and confidentiality in handling sensitive vendor information.