TPRM Continuous Monitoring Analyst

TPRM Continuous Monitoring Analyst

Location: Chicago, IL preferred – Hybrid 3 days onsite / 2 days remote; fully remote candidates will also be considered

Employment Type: Contract

Duration: Estimated at 5+ months

Pay Rate: $60-65/hour W2

Position Overview

Our client, a large, well-known Insurance Firm is targeting an experienced Third-Party Risk Management (TPRM) Continuous Monitoring Analyst to support the ongoing oversight and risk assessment of critical third-party vendors within a large, highly regulated organization.

This is a hands-on third-party risk practitioner role focused on evaluating changes in vendor risk posture, investigating risk intelligence alerts, conducting vendor reassessments, reviewing controls and supporting evidence, and determining when identified risks require remediation or escalation.

The ideal candidate will bring experience with continuous monitoring, third-party/vendor risk assessments, SOC report reviews, risk and control frameworks, and risk remediation. Experience with SupplyWisdom, Black Kite, and/or ProcessUnity is highly desirable and will be given preference.

Key Responsibilities

Continuous Monitoring & Risk Intelligence

• Monitor third-party risk intelligence feeds and evaluate alerts across cybersecurity, financial, operational, geopolitical, compliance, and reputational risk domains.
• Perform initial triage and severity validation of incoming alerts.
• Investigate alert context, vendor history, existing controls, and potential business impact to determine materiality and whether escalation is warranted.
• Conduct trigger-based reviews following events such as breach disclosures, sanctions or adverse media findings, material cybersecurity vulnerabilities, and vendor notifications.
• Monitor changes in vendor risk posture based on inherent risk, data sensitivity, concentration risk, and business criticality.
• Escalate significant findings in accordance with established risk thresholds and service-level requirements.

Third-Party Risk Assessments

• Conduct periodic vendor risk assessments and reassessments using standardized questionnaires and assessment methodologies.
• Review due diligence questionnaires, vendor responses, supporting documentation, and control evidence.
• Evaluate controls across cybersecurity, information security, privacy, operational resilience, business continuity, and regulatory compliance.
• Review SOC reports and related compliance documentation as part of ongoing vendor oversight.
• Identify control deficiencies, deterioration in vendor risk posture, newly introduced risks, and recurring or systemic issues.
• Assess inherent and residual risk and clearly document the rationale supporting risk-rating decisions.

Risk Investigation & Remediation

• Investigate third-party risk findings using available risk intelligence, vendor documentation, control evidence, and internal information.
• Partner with subject matter experts across Information Security, Privacy, Legal, Compliance, Business Continuity, and other risk functions to validate findings.
• Determine whether identified risks require remediation, acceptance, additional investigation, or escalation.
• Track remediation activity and maintain clear documentation of findings, decisions, and outcomes.
• Provide support to internal relationship managers and third-party suppliers throughout the reassessment and remediation process.

Reporting & Documentation

• Maintain complete and audit-ready records of continuous monitoring activities, assessments, escalations, findings, and remediation efforts.
• Document risk assessments, risk ratings, and recommendations within the organization's TPRM platform.
• Prepare operational dashboards and status reporting highlighting monitoring activity, significant findings, remediation progress, and emerging risks.
• Support executive reporting related to critical third-party risks, SOC/compliance reviews, and vendor risk trends.
• Clearly communicate complex risk findings to both technical and non-technical stakeholders.

Required Qualifications

• Experience in Third-Party Risk Management (TPRM), Vendor Risk Management, third-party cybersecurity risk, IT risk, or vendor assessments.
• Demonstrated experience with continuous monitoring and risk intelligence, including investigation and triage of third-party risk alerts.
• Experience conducting third-party risk assessments, reassessments, due diligence reviews, or control assessments.
• Knowledge of common risk and control frameworks, including NIST, ISO 27001, SOC 2, and/or SIG.
• Experience reviewing SOC reports, security documentation, vendor questionnaires, and control evidence.
• Understanding of inherent risk, residual risk, control effectiveness, remediation, and risk escalation.
• Strong investigative and analytical skills with the ability to interpret complex risk signals and determine materiality.
• Strong written and verbal communication skills with the ability to clearly explain risk findings and recommendations.
• Ability to manage multiple assessments and priorities within a deadline-driven environment.
• Strong attention to detail and commitment to accurate, audit-ready documentation.

Preferred Qualifications

• Hands-on experience with SupplyWisdom and/or Black Kite for third-party risk intelligence and continuous monitoring.
• Experience with ProcessUnity or a comparable TPRM/GRC platform.
• Experience monitoring third parties across multiple risk domains, including cyber, financial, geopolitical, compliance, reputational, and operational risk.
• Experience working within a large, regulated corporate environment.
• Demonstrated experience partnering with Information Security, Privacy, Legal, Compliance, Business Continuity, and other risk stakeholders.