Millennium
Third-Party Risk Management 1
$175K–$250K
New York, New York · On-site · Full-time · Posted Sep 10, 2026
- Experience
- Five or more years of hands-on third-party risk management experience.
- Education
- Bachelor’s degree or higher in Computer Science, Computer Engineering, Cybersecurity, Information Security, or a related field, or commensurate work experience.
About the job
Conduct and improve vendor security risk assessments, communicate findings, and track remediation to protect the firm from third-party risks.
What you'll do
- Assess vendor security, evidence, dependencies, business impact, and residual risk; recommend remediation or risk acceptance.
- Report assessment findings, maintain risk records, communicate requirements, and track remediation with stakeholders.
- Monitor vendors and strengthen the third-party risk program, including its methodology, questionnaires, reporting, and automation.
What they ask for
- Experience conducting vendor or third-party security risk assessments and familiarity with NIST CSF, SOC 2, ISO 27001, CIS Controls, SIG, and CAIQ.
- Ability to analyze penetration-test reports and architecture or data-flow diagrams for security risks.
- Strong risk judgment, communication, and ability to manage multiple assessments and deadlines.
- Bachelor’s degree or higher in a related field, or commensurate work experience.
Nice to have
- Certifications such as CTPRP, CTPRA, CISA, or CISSP.
- Experience with AI model security and governance; familiarity with infrastructure, TPRM platforms, reporting and automation tools, and Windows, Linux, and macOS.
Pay
$175,000 to $250,000 USD base salary
Tools
NIST CSF, SOC 2, ISO 27001, CIS Controls, SIG, CAIQ, Windows, Linux
AI focus
Preferred experience with secure use, deployment, and governance of AI models, tools, and supporting infrastructure, including GPUs and inferencing workloads.
Model-written summary · the original posting is authoritative