Black Duck - Third-Party Risk Analyst (6-8 yrs)

About the Role :

As a Third-Party Risk Analyst, you will play a crucial role in safeguarding our organization by managing and mitigating risks associated with third-party vendors.

You will work closely with internal stakeholders and external vendors to ensure compliance with security standards and regulations.

Key Responsibilities :

- Conduct thorough risk assessments of third-party vendors, including evaluating their security controls, data protection practices, and business continuity plans.

- Develop and maintain risk rating methodologies to prioritize risk treatments.

- Onboard and manage third-party vendors throughout their lifecycle, from initial assessment to termination.

- Monitor vendor performance and compliance.

- Enforce contractual obligations and security requirements.

- Identify and implement risk mitigation strategies, such as security controls, contractual terms, and monitoring activities.

- Work with vendors to address security vulnerabilities and compliance gaps.

- Ensure compliance with relevant regulations and industry standards, including ISO 27001, NIST SP 800-53, and GDPR.

- Stay informed about emerging threats and vulnerabilities.

- Develop and maintain key performance indicators (KPIs) to measure the effectiveness of the TPRM program.

- Generate regular reports on third-party risk exposure and compliance status.

- Respond to security incidents involving third-party vendors.

- Coordinate with internal and external teams to mitigate the impact of security breaches.

Qualifications :

- 5+ years of experience in Third-Party Risk Management.

- Strong understanding of information security principles and practices.

- Experience with risk assessment methodologies and frameworks.

- Familiarity with regulatory requirements (GDPR, HIPAA, PCI DSS).

- Excellent analytical and problem-solving skills.

- Strong communication and interpersonal skills.

- Ability to work independently and as part of a team.

- Certification in information security (CISSP, CISM, CRISC) is a plus