Bachelor's Degree or equivalent experience in relevant theories and principles
6+ years of experience in Third Party Risk Management (TPRM)
6+ years of experience with Vendor Control Assessments and SOC2 reports
In-depth knowledge of TPRM processes, reporting, and best practices
Strong analytical skills for process analysis and problem-solving
Excellent communication and collaboration skills
Solid understanding of NIST 800 CSF and familiarity with the gas and electric utility industry
Responsibilities
Develop and execute the Cyber Assessments program for Third Party Risk Management
Collaborate with various teams to educate on Third Party Risk Profiles
Manage and report on Third Party Cyber Risks, maintaining risk profiles
Communicate assessment results to management and vendor relationship owners
Analyze vendor risk posture and assist in informed decision-making
Support the implementation of Cyber Assessment roadmaps and methodologies
Assist in executing Cyber assessments while ensuring adherence to Supply Chain processes
Benefits
Hybrid work environment in Columbus, OH or Merrillville, IN
Opportunity to work with cross-functional teams
Engagement in process improvement initiatives
Access to advanced tools like Archer and Fortress for Cyber Assessments
Professional development opportunities in Cyber Risk Management
Full Job Description
Manifest Solutions is currently seeking a Senior Cyber Risk Analyst for a hybrid position in Columbus, OH or Merrillville, IN.
Develop, maintain, and execute the Cyber Assessments program, also known as Third Party Risk Management (TPRM), and Technology support. Cyber Assessments include Supplier / Vendor Control Assessments using GRC platform and coordinating Supplier assessments such as inherent risk rank and Control assessments to provide transparency into Third Party Risk Profiles.
Work collaboratively with numerous teams including NERC CIP Compliance, Pipeline Compliance, Innovation, Supply Chain, IT, Enterprise Security, Internal Audit and the business to educate and inform business partners of Third Party Risk Profiles.
Responsible for managing and reporting on Third Party Cyber Risks by maintaining risk profiles, tracking supplier issues and exceptions, and using tools to create reports, dashboards and metrics.
Works closely with the Director of Enterprise Security GRC, the Manager Cyber Assessments, the Manager(s) Cyber Compliance, and others as needed to ensure that all assessment results are addressed and leverages GRC Platform and adoption of the program.
Communicate results to management, vendor relationship owners, and supply chain related to Continuous Monitoring.
Partners with Supply Chain and Cyber Vulnerability Management to provide Third Party Risk Profiles as part of the Supply Chain vendor onboarding and contract renewal processes
Interfaces with key systems of record (i.e. Workday, Service Now, etc.)
Analyze vendor risk posture, identify risk items, tracking of exceptions, and other data to assist management in making more informed decisions relative to vendor management
Help ensure that company and contracted services are performed to satisfaction
Perform routine assignments in the Cyber Assessment Analyst job band, under the direction of the Director of Cyber and the Manager Cyber Assessments
Work closely with the business, OT, IT, and Cyber and Service Providers to perform and/or support TPRM and Cyber Assessment processes
Assist in driving the implementation of the roadmaps for Cyber Assessments, Archer, and Fortress Control Assessments
Assist in executing the Cyber Assessment (CA) program, ensuring a methodology is used and communicated relative to when a Cyber Assessment is performed, risks are mitigated, results are communicated, and metrics are produced supporting the program.
Executes or assists others in executing Cyber assessments supporting the business, Cyber, IT, OT, and the Innovation line of business ensuring Supply Chain processes are adhered to.
Reviews must meet stated objectives, budget requirements, timeline requirements and reporting/readout requirements
Supports and strives to be knowledgeable relative to Fortress Control Assessments, contributing to the direction of the product, our leveraging of the tool, and the ongoing business benefit
Supports and strives to be knowledgeable relative to Archer, contributing to the direction of the product, our leveraging of the tool, and the ongoing business benefit
Serves as an Archer ambassador across company as to capabilities and expanded adoption
Assist in audit/issues tracking and resolution for processes related to Cyber Assessments as requested Advance the use and adoption of Archer RSA to maintain and manage risk, compliance, and policy monitoring and tracking
Minimum Qualifications:
Bachelor's Degree or equivalent work experience that provides knowledge and exposure to fundamental theories, principles, and concepts
6+ years' TPRM experience in varying support functions
6+ years of experience with Vendor Control Assessments, SOC2 reports and metrics
In-depth experience with TPRM processes, reporting and metrics Knowledge of TPRM components, trends, and best practices.
Solid skills with computers, operating systems, and software (MS Office 365 suite of products) and ability to learn new technical concepts quickly.
Analytical abilities, including process analysis and development, problem solving and root cause analysis.
Teaming skills, collaboration, negotiation, communication, organizational, people management and conflict resolution skills.
Involvement in multiple process improvement initiatives
Good written and verbal communication
Demonstrated participation in successful delivery of TPRM projects
Can work independently in multiple functional domains with minor assistance
Solid understanding of NIST 800 CSF.
Working knowledge of the gas and electric utility industry; additional experience a plus
Preferred Qualifications
Demonstrated experience in Microsoft Excel and Word
