Third-Party Risk Management (TPRM) Junior Analyst

Third-Party Risk Management (TPRM) Junior Analyst 

(Remote candidates will be considered)  

 

 

National Digital Trust Company (In Organization) has received conditional approval from the Office of the Comptroller of the Currency to open as a federally chartered trust bank to provide a broad range of digital asset services.

 

We are building a specialized financial institution addressing the growing demand for digital asset services. Our primary business will focus on digital asset custody, providing secure, efficient custodial and fiduciary services for a variety of digital assets. 

You will work with foundational systems and processes to help shape our operating model and influence how a new category of financial infrastructure comes to market.

We are looking for builders who handle complexity with confidence and tackle ambitious opportunities while keeping pace with this rapidly evolving industry.  Let’s build this together!

 

Our Principles 

 

Greatness is a mindset, not an accomplishment. Mediocrity is unacceptable. Excellence is contagious. We hire people because we believe in their greatness. Now is the time to prove us right.

 

Responsibility comes with the territory. Everyone is an owner, which means we share a common vision and mutual accountability. We act in line with our strategic objectives and the trust our customers place in us. We believe there is no such thing as "not my problem." Taking this level of ownership not only drives our collective success but also offers the potential for significant reward.

Innovation and adaptation are in our DNA. We are in a period of the most dramatic and rapid period of technological change in the history of humankind. Those that stay ahead will thrive, those that don't, won't. We innovate intelligently and thrive on overcoming challenges, to get (at least) a little better every day and ensure our continued growth and success.

Team first. We are reliable teammates working together toward extraordinary success through honesty and accountability. We believe collaboration knows no hierarchy, and we focus on what matters.  We work toward consensus, but when necessary, we disagree and commit. We know that winners win.

 

    

Job Overview 

Our company is seeking a highly motivated Third-Party Risk Management (TPRM) Junior Analyst to support its Third-Party Risk Management program within a highly regulated banking environment. This role is critical in ensuring third-party relationships meet regulatory expectations and cybersecurity standards. 

The ideal candidate will have 1–3 years of experience in third-party risk, information security, IT audit, or compliance, along with a strong understanding of cybersecurity controls, risk assessment methodologies, and regulatory expectations applicable to financial institutions. Experience reviewing NIST, ISO 27001, and SOC reports is required. 

This role requires the ability to assess technical controls, identify control gaps, and evaluate vendor cybersecurity maturity, aligning with regulatory expectations, including OCC guidance. 

 

Objectives 

Third-Party Risk Assessments 

Conduct initial and ongoing risk assessments for new and existing vendors, with emphasis on cybersecurity and data protection 

Evaluate vendor due diligence responses, including information security, security architecture, and cloud environments 

Identify control gaps and recommend risk mitigation strategies 

Assess vendors handling sensitive data, critical systems, or customer information 

 

Regulatory & Compliance Alignment 

Support vendor due diligence, concentration risk, fourth-party risk, and business continuity assessments 

Assist with preparation for regulatory examinations and internal audits 

Maintain documentation demonstrating regulatory compliance and risk-based decision making 

Support updates to TPRM policies, procedures, and standards 

 

Framework & Control Evaluation 

Assess vendor security programs against recognized frameworks, including: 

         NIST Cybersecurity Framework, ISO 27001, SOC 2 Type II 

 Ongoing Monitoring 

Support monitoring of critical and high-risk vendors, including: Annual reassessments, Incident reviews, Cybersecurity attestations, Financial health reviews 

Track vendor performance, compliance, and remediation activities 

Prepare risk summaries and reporting materials for leadership 

Escalate significant risks in a timely manner 

 

Incident & Resilience Oversight 

Review vendor incident response and breach notification processes 

Evaluate business continuity and disaster recovery capabilities 

Participate in vendor-related incident response activities as needed 

 

Reporting & Governance 

Prepare concise risk reports for senior leadership and risk committees 

Maintain accurate documentation within the TPRM system 

Support reporting on third-party cyber risk exposure and metrics 

 

Collaboration & Communication 

Partner with Information Security, Compliance, Legal, Procurement, and business units 

Communicate findings clearly to both technical and non-technical stakeholders 

Provide guidance to business owners on third-party risk requirements 

 

What you bring to our company 

Bachelor's degree in business, Information Security, Cybersecurity, Risk Management, Finance, or related field. 

1-3 years of experience in TPRM and Information security risk 

 

Preferred Qualifications: 

Experience working in an OCC-regulated financial institution 

Exposure to cloud risk management (AWS, SaaS environments) 

Experience using TPRM platforms 

 

Working Knowledge of: 

Risk assessment methodologies (inherent vs. residual risk) 

NIST Cybersecurity Framework 

ISO 27001 

SOC 2 reports 

 

Key Competencies: 

Attention to detail 

Critical thinking and analytical ability 

Strong written and verbal communication 

Strong cybersecurity risk mindset 

Ability to evaluate technical control environments 

Risk-based decision making 

Attention to regulatory detail 

Ability to manage multiple vendor assessments simultaneously 

Professional communication with both technical and non-technical stakeholders 

 

 

We promote diversity of thought, culture, background, and experience. We are an equal opportunity employer, and employment at our company is based solely on one's merit and qualifications directly related to professional competence. We do not discriminate based on race, creed, color, ancestry, religion, gender, sexual orientation, gender identity, national origin, age, disability, genetic information, military or veteran status, or any other characteristics protected by law. 

 

Featured benefits 

Employer-provided: Medical, Dental, and Vision insurance, 401(k), life and disability insurance.