TPRM Continuous Monitoring Analyst

This is a fully remote position, open to applicants in Oregon.

📋 Description

• Engage in continuous oversight of essential vendors, including regular reassessments and trigger-based evaluations.

• Daily monitor Supply Wisdom and Black Kite risk intelligence feeds across various risk domains such as cyber, financial, operational, geopolitical, compliance, and reputational risks.

• Assess and validate alert severity, investigate context and vendor history, and ascertain whether escalation is necessary.

• Execute focused assessments prompted by breach disclosures, sanctions, adverse media mentions, significant CVE exposures, and breach notifications.

• Track the risk posture of vendors and maintain monitoring tiers aligned with inherent risk, data sensitivity, concentration risk, and business significance.

• Carry out thorough third-party vendor risk assessments and reassessments utilizing IRQ/DDQ frameworks.

• Analyze vendor responses, supporting documentation, and the effectiveness of controls in ProcessUnity.

• Review annual SOC reports for suppliers.

• Detect control enhancements or declines, newly introduced risks, and ongoing or systemic issues.

• Evaluate vendor risk posture and identify any gaps or concerns.

• Cooperate with subject matter experts in InfoSec, Privacy, Legal, Compliance, and Business Continuity.

• Document risk trend analyses and the rationale for changes in inherent or residual risk ratings.

• Escalate Critical and High alerts for Tier 1 and Tier 2 vendors within established SLA timeframes.

• Communicate issues to Relationship Managers and risk stakeholders while logging outcomes in ProcessUnity.

• Provide internal business and supplier assistance throughout reassessments.

• Record assessment results, risk ratings, and recommendations in ProcessUnity.

• Generate monthly operational dashboards and status reports.

• Assist in quarterly executive reporting on primary risks, findings, and SOC/compliance reviews.

• Maintain precise, audit-ready records of monitoring, escalation, and reassessment activities.

⛳️ Requirements

• Experience in third-party risk management, vendor assessments, or IT risk management.

• Knowledge of risk and control frameworks, including NIST, ISO 27001, SOC 2, and SIG.

• Proficient understanding of risk assessment methodologies and control validation across information security, privacy, business continuity, and compliance domains.

• Strong analytical, communication, and stakeholder management abilities.

• Capability to juggle multiple priorities and adhere to deadlines in a dynamic environment.

• Attention to detail with an emphasis on accuracy and thoroughness.

• Risk-based judgment and the ability to interpret and prioritize risk signals.

• Competent decision-making within defined thresholds and escalation protocols.

• Collaborative skills across cross-functional risk stakeholders.

• Ownership, accountability, and the capacity to deliver measurable, actionable outcomes.

🏝️ Benefits

• Medical, dental, and vision coverage.

• Critical Illness, Accident, and Hospital insurance.

• 401(k) Retirement Plan with options for pre-tax and Roth post-tax contributions.

• Voluntary Life & AD&D insurance for employees and their dependents.

• Short- and long-term disability coverage.

• Health Spending Account (HSA).

• Transportation benefits.

• Employee Assistance Program.

• Paid Time Off/Leave (PTO, Vacation, or Sick Leave).