Operational Risk Analyst / Third Party Risk Analyst

Job Description

Job Title: Senior Business Risk Analyst

\n

Location: Mclean, VA (Fully Onsite)

\n

Duration: 6+ months Contract TO HIRE

\n

\n

Must Have Qualifications:

\n

Strong experience in operational risk, third-party risk management, information security, and financial statement analysis, with hands-on knowledge of SOC reviews (including SOC 1 Type 2) and related controls. An IT audit background is preferred, enabling effective evaluation of third-party relationships and information security measures

\n

\n

Hiring Manager Notes

\n

\n
• Third-party risk and information security are the biggest priorities.
\n
• Candidates with IT risk, operational risk, or IT audit backgrounds are worth considering. The manager is more concerned with actual experience than previous job titles.
\n
• This is not a testing position. The focus is on risk operations, SOC reviews, reconciliations, and process improvements.
\n
• Excel does not need to be extremely advanced. Moderate Excel skills are acceptable.
\n
• Model governance is preferred but not required.
\n
• Strong communication and documentation skills are important.
\n
• Although this is a Team Lead position, there are no direct reports. The person will work directly with the hiring manager.
\n

\n

\n

Interview Type:

\n

MS Teams - Video Mandatory for 1st round| 2nd round is In Person

\n

\n

Core requirements & skills

\n

• Strong background in third-party risk, information security, and operational risk; familiarity with IT general controls (ITGC) is critical.

\n

• Experience with SOC 1 Type II and SOC 2 Type II reviews and related controls; ability to assess third-party SOC reports for critical suppliers.

\n

• Financial statement analysis knowledge is desirable primarily to interpret SOC controls that affect financial reporting.

\n

• Excel skills: ability to apply formulas and automate reconciliations; level described as moderate (not advanced); Power BI helpful but not required.

\n

• Preferred: IT audit or operational risk background, model-governance exposure, and strong written/verbal skills for SOPs and external stakeholder communication

\n

\n

Key Responsibilities

\n

\n
• Support third-party risk management activities, including supplier risk assessments and SOC report reviews.
\n
• Review SOC 1 Type 2 and SOC 2 reports, related controls, and potential security or operational risks.
\n
• Evaluate third-party risks related to information security, data security, and IT general controls.
\n
• Support AI solutions inventory, including user inquiries, system owner questions, and ongoing operational activities.
\n
• Assist with monthly and quarterly reconciliations, reporting, and data analysis.
\n
• Work with technology teams, product owners, and first- and second-line risk stakeholders.
\n
• Identify opportunities to streamline processes and improve existing workflows.
\n
• Use Excel for data analysis, reconciliations, and basic automation.
\n
• Develop and update SOPs, process documentation, and training materials.
\n
• Assist with gathering business requirements for system enhancements or replacements.
\n

\n

\n

Nice to Have

\n

\n
• IT audit experience.
\n
• Model governance or model risk management experience.
\n
• Experience with AI inventory or model-related processes.
\n
• Business requirements gathering for technology projects.
\n
• Financial services or regulated industry experience.
\n

\n