City/State

Work Shift

Overview:

Third Party Risk Management (TPRM) Senior Analyst is responsible for ensuring the organization effectively manages risks associated with third-party vendors and partners throughout the entire third-party lifecycle including vendor selection contract negotiation ongoing monitoring and termination. This involves not only identifying and evaluating risks but also collaborating with various teams particularly Legal and Procurement to embed risk mitigation strategies into contractual agreements.

Key responsibilities

• Vendor Risk Assessment (VRA):
  • Conduct thorough risk assessments for potential and existing vendors focusing on various risk types including cybersecurity operational financial and compliance risks.
  • Utilize and potentially create vendor risk assessment questionnaires to gather detailed information about vendor practices including data security policies internal controls compliance posture and business continuity plans.
  • Analyze questionnaire responses and other relevant information to identify deficiencies areas for remediation and categorize vendors based on risk levels.
  • Engage with stakeholders to communicate assessment results address security concerns and collaborate on potential remediation actions.
  • Perform periodic reviews and reassessments of existing vendors to ensure ongoing compliance and address evolving risks.
• Contract Negotiation:
  • Partner with Legal and Procurement teams during contract negotiations to ensure security privacy and other relevant risk clauses are adequately addressed.
  • Provide expert guidance on acceptable and unacceptable contract terms related to risk management service level agreements (SLAs) and data protection.
  • Work to define and include clear performance standards due diligence requirements and exit strategies within contracts.
• TPRM program development and maintenance:
  • Support the development maintenance and enhancement of the organizations Third-Party Risk Management program and framework.
  • Develop and update TPRM procedures to ensure alignment with organizational policies and regulatory requirements.
  • Identify and implement process efficiencies within the TPRM program and perform analyses on team metrics to enhance effectiveness.
• Stakeholder collaboration and communication:
  • Build and maintain strong relationships with internal stakeholders across departments such as Legal Procurement Information Security and Business Units.
  • Provide TPRM guidance and training to Vendor Relationship Owners and business partners on risk management practices.
  • Communicate identified risks assessment results and mitigation strategies to stakeholders including senior management clearly and concisely.
• Ongoing monitoring and remediation:
  • Track identified risks associated with third parties and ensure timely reviews are performed.
  • Monitor key supplier performance against established SLAs and regulatory requirements.
  • Track and collaborate with internal partners and vendors to remediate any risk-related issues.

Education

• Bachelors degree in a relevant field such as Business Finance Information Technology or a related discipline (Preferred)
• Experience in lieu of Bachelors Degree -7 years of relevant experience without a degree

Certification/Licensure

• CISA CRISC CISM CISSP or other relevant certifications are preferred

Experience

• 5 years of relevant experience with a degree
• Strong understanding of Third-Party Risk Management (TPRM) principles concepts and best practices.
• Experience in conducting vendor risk assessments and evaluating internal controls potentially leveraging frameworks like ISO 27001/2 NIST 800-53 NIST CSF SOC1/SOC2 CSA CCM and Shared Assessments SIG.
• Working knowledge of contract management principles and practices including contract negotiation and analysis.
• Excellent communication skills both written and verbal with the ability to effectively articulate security control requirements assessment results and risk considerations to diverse audiences.
• Strong analytical critical thinking and problem-solving skills with the ability to digest and analyze complex information with attention to detail and accuracy.
• Ability to work collaboratively in a cross-functional environment and build strong relationships with internal and external partners.
• Proficiency in Microsoft Office Suite (Excel PowerPoint Word) and potentially GRC (Governance Risk and Compliance) tools like OneTrust (highly desirable) Archer or ServiceNow

Keywords: TPRM Third party Risk assessment

Sentara Health is an equal opportunity employer and prides itself on the diversity and inclusiveness of its close to an almost 30000-member workforce. Diversity inclusion and belonging is a guiding principle of the organization to ensure its workforce reflects the communities it serves.

In support of our mission to improve health every day this is a tobacco-free environment.

For positions that are available as remote work Sentara Health employs associates in the following states:

Alabama Delaware Florida Georgia Idaho Indiana Kansas Louisiana Maine Maryland Minnesota Nebraska Nevada New Hampshire North Carolina North Dakota Ohio Oklahoma Pennsylvania South Carolina South Dakota Tennessee Texas Utah Virginia Washington West Virginia Wisconsin and Wyoming.