Job Overview The Risk, Performance & Management (RPM) team is located in the new LEED certified Carolinas campus (Fort Mill, SC). As a Senior Third Party Risk Management Assessor, you will assess LPL's third party's control environments, including escalation and remediation of identified third party issues with line of business partners, while providing robust and challenging insight on business risk, and on the adequacy and effectiveness of the third party's controls.
RPM's mission is to 1) Deliver sustainable, ethical practices and leadership to enable the selection of external partners to drive the best service, quality, and value for LPL while appropriately mitigating risk. 2) Provide leadership to our business partners through LPLs center-led Vendor Management Program to ensure that any contractual and performance risks are effectively mitigated.
Responsibilities: - Perform third party risk assessments by analyzing questionnaires such as Standard Information Gathering (SIG) third-party engagement profiles and due diligence evaluations.
- Manage all aspects of complex third party risk assessments that may entail collaboration with cross-functional internal teams.
- Create comprehensive, articulate and objective reports to effectively communicate and relate security, compliance, or governance-related concepts and controls across a variety of audiences including technical and non-technical audiences.
- Maintain a current understanding of relevant third party risk management best practices, regulations and Information Security Principles.
- Develop positive working relationships to maintain an open environment for collaboration, risk identification and remediation.
- Conduct Risk Assessments: Lead and execute comprehensive inherent and residual risk assessments of third parties to identify potential security threats, vulnerabilities, and compliance gaps. Meet individual goals as assigned by your manager.
- Due Diligence and Evidence Validation: Collect and analyze information and evidence from third parties, including security questionnaires (e.g., SIG, CAIQ), SOC 2 reports, ISO 27001 certifications, penetration test results, and other audit artifacts, to determine the effectiveness of their controls.
- Identify and Document Findings: Document identified security gaps, vulnerabilities, and non-compliance issues. Translate complex technical findings into business-level risks for stakeholders.
- Develop and Track Remediation Plans: Collaborate with vendors and internal business leaders to develop risk mitigation strategies and action plans. Monitor and track the progress of remediation efforts to ensure timely closure of vulnerabilities.
- Monitor Continuously: Support ongoing monitoring activities to track third-party compliance and performance, using tools like Security Scorecard or BitSight to detect posture changes or emerging risks in real-time.
- Ensure Regulatory Compliance: Verify that third-party vendors adhere to applicable laws, regulations, and industry standards such as GDPR, HIPAA, NIST, ISO 27001, and organizational policies.
- Collaborate with Stakeholders: Partner with cross-functional teams, including Legal, Procurement, IT, Compliance, and business units, to ensure a cohesive and standardized approach to third-party risk management.
- Support Audits and Reporting: Assist in internal and external audits and regulatory reviews by providing documentation and evidence of TPRM program activities. Create reports and executive dashboards summarizing vendor risk posture for senior management.
- Process Improvement: Proactively contribute to the development and enhancement of TPRM policies, procedures, and tools, including exploring automation and AI solutions to improve efficiency and effectiveness.
What are we looking for?We're looking for strong collaborators who deliver exceptional client experiences and thrive in fast-paced, team-oriented environments. Our ideal candidates
pursue greatness,
act with integrity, and are
driven to help our clients succeed. We value those who embrace creativity, continuous improvement, and contribute to a culture where we
win together and
create and share joy in our work.
Requirements: - 3-5 years' experience in Third Party Risk Management in financial services or other highly regulated industries
- Experience using GRC Tools (OneTrust; OneTrust certification would be highly desirable)
Core Competencies: - Strong organizational skills with attention to detail, in order to meet deadlines in an environment of continually changing priorities
- Ability to work comfortably with incomplete information and deal with ambiguity in a fast-paced environment while maintaining a sense of humor and cheerful attitude
- Ability to adjust priorities and monitor workload to meet departmental SLA's
Preferences: - Well rounded basic security, and regulatory framework knowledge and experience, including, but not limited to: ISO 27001, SIG, SOC reports, NIST, CSA as well as Privacy, Compliance, Business Resiliency, Cyber and other risk domains
- Advanced MS Office skills including Excel, SharePoint, Word and Power Point
- Third Party Risk Management related certifications highly desired
Pay Range: $79,825.00 - $132,973.00
Actual base salary varies based on factors, including but not limited to, relevant skill, prior experience, education, base salary of internal peers, demonstrated performance, and geographic location. Additionally, LPL Total Rewards package is highly competitive, designed to support your success at work, at home, and at play - such as 401K matching, health benefits, employee stock options, paid time off, volunteer time off, and more. Your recruiter will be happy to discuss all that LPL has to offer!
