Vendor Onboarding Specialist

Back to job search Specialist, Third-Party Operations Posted 2 weeks ago New York, NY, 10003, US $50.00 - $62.50 per hour Contract Industry: Utility and Energy Start Date: 2026-11-02 Job Ref: 26-10725 Apply Save job Specialist, Third-Party Operations – Third-Party Risk Management Location: New York, NY Schedule/Shift: 8-hour workday; fully onsite for the first 30 days, then hybrid with a minimum of 3 days onsite per week Pay: $50–$62.50 per hour 26-10725 Job Summary The Third-Party Risk Management Specialist independently conducts vendor risk assessments to evaluate cybersecurity controls, data privacy practices, regulatory compliance, and potential business risks. This role reviews vendor documentation and security evidence, identifies control gaps, assigns risk ratings, and documents findings and recommendations to support informed business decisions. The specialist manages assessments throughout the third-party lifecycle, monitors remediation activities, and collaborates with Procurement, Legal, Information Security, Privacy, and other stakeholders to strengthen risk management practices. Job Responsibilities Independently conduct and complete third-party risk assessments, including reviewing evidence, evaluating controls, identifying deficiencies, and documenting risk ratings and recommendations. Evaluate vendor security controls when SOC 2 Type II reports or equivalent certifications are unavailable by reviewing security policies, ISO certifications, penetration testing results, and other independent evidence. Assess third-party risks related to cybersecurity, data privacy, personally identifiable information (PII), regulatory compliance, and Payment Card Industry (PCI) requirements. Review vendor security questionnaires, including Standardized Information Gathering (SIG) assessments, validate responses against supporting evidence, identify inconsistencies, and request clarification when needed. Use third-party risk management (TPRM) and governance, risk, and compliance (GRC) platforms to manage assessments, document findings, and track remediation activities. Conduct ongoing monitoring and periodic reassessments in response to security incidents, regulatory changes, financial concerns, ownership changes, and subcontractor changes. Evaluate control effectiveness and recommend remediation plans or other risk mitigation measures. Support third-party due diligence, risk assessment, approval, monitoring, and offboarding processes. Track and report risk metrics, including assessment timelines, outstanding high-risk findings, and remediation progress. Collaborate with Procurement, Legal, Information Security, Privacy, Risk Management, and business stakeholders to communicate assessment outcomes and support risk-based decisions. Evaluate relevant business and financial risks, including insurance-related considerations such as underwriting, claims, fraud, and financial exposure. Contribute to improvements in risk assessment procedures, monitoring practices, and the overall TPRM framework. Job Requirements Minimum 3 years of relevant professional experience, with demonstrated hands-on responsibility for independently conducting and completing third-party risk assessments. Experience reviewing vendor documentation and technical evidence, evaluating security controls, identifying deficiencies, and documenting assessment conclusions and recommendations. Working knowledge of cybersecurity risk management, data privacy, PII protection, and applicable regulatory requirements, including GDPR, CCPA, and PCI considerations. Experience reviewing SOC reports, ISO certifications, security policies, penetration testing results, and other vendor security evidence. Experience analyzing SIG or comparable vendor risk questionnaires and validating vendor responses against supporting documentation. Practical experience with enterprise TPRM or GRC platforms, such as KY3P, Archer, ServiceNow, Aravo, Coupa, or Mitratech/Prevalent. Understanding of continuous monitoring, ongoing monitoring, risk remediation, periodic reassessments, and third-party risk reporting. Strong analytical, critical-thinking, documentation, and communication skills. Ability to exercise sound risk judgment, work independently, and collaborate effectively with technical and business stakeholders. Bachelor’s degree in a related field. Preferred Qualifications Experience with KY3P or other enterprise third-party risk management platforms. Experience assessing vendors in regulated industries, particularly financial services or insurance. Familiarity with emerging third-party risks, including cybersecurity threats, geopolitical developments, and supply chain disruptions. Experience evaluating PCI compliance documentation, including Attestations of Compliance (AOCs) and Reports on Compliance (ROCs). Experience improving TPRM workflows, assessment processes, reporting, and risk monitoring practices. About Equiliem Equiliem believes in empowering success. It’s our job to cultivate relationships that connect people and employers in a way that is inclusive, intelligent, and allows both to thrive. Across the U.S., leading companies in healthcare, government, engineering, manufacturing, professional services, and energy rely on us for their workforce solutions. Our recruiting and HR services include contract and direct hire staffing, Payrolling/EOR, Independent Contractor Compliance, and Managed Services. For almost 30 years, we’ve helped shape our industry. Today, we continue to research, ask questions, and continuously enhance the candidate journey and client experience. Benefits We offer a comprehensive benefits package to our employees, which includes: Medical Insurance Vision & Dental Insurance Life Insurance Matching 401(k) Commuter Benefits Employee Discounts & Rewards Payroll Payment Options Future Communication Consent By applying, you are providing consent for Equiliem to engage with you via phone calls, AI-generated calls, AI-generated text