Operational Risk Analyst / Third Party Risk Analyst

Job Title: Senior Business Risk Analyst

Location: Mclean, VA (Fully Onsite)

Duration: 6+ months Contract TO HIRE

Must Have Qualifications:

Strong experience in operational risk, third-party risk management, information security, and financial statement analysis, with hands-on knowledge of SOC reviews (including SOC 1 Type 2) and related controls. An IT audit background is preferred, enabling effective evaluation of third-party relationships and information security measures

Hiring Manager Notes

• Third-party risk and information security are the biggest priorities.
• Candidates with IT risk, operational risk, or IT audit backgrounds are worth considering. The manager is more concerned with actual experience than previous job titles.
• This is not a testing position. The focus is on risk operations, SOC reviews, reconciliations, and process improvements.
• Excel does not need to be extremely advanced. Moderate Excel skills are acceptable.
• Model governance is preferred but not required.
• Strong communication and documentation skills are important.
• Although this is a Team Lead position, there are no direct reports. The person will work directly with the hiring manager.

Interview Type:

MS Teams - Video Mandatory for 1st round| 2nd round is In Person

Core requirements & skills

• Strong background in third-party risk, information security, and operational risk; familiarity with IT general controls (ITGC) is critical.

• Experience with SOC 1 Type II and SOC 2 Type II reviews and related controls; ability to assess third-party SOC reports for critical suppliers.

• Financial statement analysis knowledge is desirable primarily to interpret SOC controls that affect financial reporting.

• Excel skills: ability to apply formulas and automate reconciliations; level described as moderate (not advanced); Power BI helpful but not required.

• Preferred: IT audit or operational risk background, model-governance exposure, and strong written/verbal skills for SOPs and external stakeholder communication

Key Responsibilities

• Support third-party risk management activities, including supplier risk assessments and SOC report reviews.
• Review SOC 1 Type 2 and SOC 2 reports, related controls, and potential security or operational risks.
• Evaluate third-party risks related to information security, data security, and IT general controls.
• Support AI solutions inventory, including user inquiries, system owner questions, and ongoing operational activities.
• Assist with monthly and quarterly reconciliations, reporting, and data analysis.
• Work with technology teams, product owners, and first- and second-line risk stakeholders.
• Identify opportunities to streamline processes and improve existing workflows.
• Use Excel for data analysis, reconciliations, and basic automation.
• Develop and update SOPs, process documentation, and training materials.
• Assist with gathering business requirements for system enhancements or replacements.

Nice to Have

• IT audit experience.
• Model governance or model risk management experience.
• Experience with AI inventory or model-related processes.
• Business requirements gathering for technology projects.
• Financial services or regulated industry experience.