Third-Party Risk Management 1
Core
Conduct security risk assessments for vendors, evaluate findings, and recommend remediation to protect Millennium's data and technology.
Role type
Senior IC third-party risk management specialist (security)
Builds
Third-party risk inventory, assessment reports, and security requirements embedded in vendor contracts
Domain
Financial services / Information security / Vendor risk management
Required skills
Vendor security risk assessment, NIST CSF, SOC 2, ISO 27001, CIS Controls, SIG, CAIQ, Penetration-test report analysis, Architecture/data-flow diagram analysis, Risk materiality assessment, Compensating controls identification, Remediation tracking
Preferred skills
CTPRP, CTPRA, CISA, CISSP, AI model governance, Cloud infrastructure, TPRM platforms, Automation tools
Technologies
NIST CSF, SOC 2, ISO 27001, CIS Controls, SIG, CAIQ, TPRM platforms, Windows, Linux, macOS
Responsibilities
Conduct security risk assessments for prospective and existing vendors, Evaluate materiality and business impact of findings, Prepare risk assessment reports and maintain third-party risk inventory, Communicate findings to technical teams and senior leaders, Track remediation of identified security gaps, Partner with procurement and legal to embed security in contracts, Monitor vendors for security incidents and adverse news, Strengthen the TPRM program through methodology improvements
Seniority
Senior, hands-on IC
