[Hiring] IT Third-Party Risk Manager @Abrigo

Role Description

Abrigo is seeking an IT Third-Party Risk Manager to lead the Third-Party Risk Management Program. The role is responsible for overseeing third-party risk management operations, including:

• Audit readiness efforts
• Security governance processes
• Customer assurance support
• Continuous improvement initiatives

The IT Third-Party Risk Manager serves as a key liaison between:

• Information Security
• Technology
• Finance
• Legal
• Product
• Business stakeholders

This position reports to the VP IT Risk & Assurance and is part of Abrigo’s CISO organization. This is a remote-first role primarily based in Raleigh, NC with quarterly onsite team engagements and periodic onsite visits during external audit fieldwork.

What You’ll Do:

• Lead operational administration of Abrigo's Third-Party Risk Management Program.
• Coordinate vendor onboarding, inherent and residual risk reviews, due diligence collection, and annual reassessments.
• Review vendor security documentation including SOC reports, security questionnaires, policies, certifications, and risk assessments and determine appropriate actions required based upon the review.
• Maintain vendor records, ownership assignments, and supporting documentation within approved governance platforms.
• Monitor vendor review schedules, risk treatment activities, contract obligations, and remediation commitments.
• Assist in developing metrics, dashboards, and reporting related to risk, compliance, vendor governance, and audit activities.
• Research new and developing technologies and standards to help contribute to the continuous improvement of the risk assessment process.
• Act as a subject matter expert in understanding why certain risks are a threat to the company and how compensating or mitigating processes affect that risk.
• Maintain and enhance policies, training materials, and operational playbooks.
• Promote continuous improvement through automation, process optimization, and effective use of technology.
• Assist with maintenance of customer assurance materials, trust documentation, and standardized security responses, with a focus on third-party activities.
• Support audit cycles through collection of evidence requests, testing coordination, issue management, and audit response activities.
• Other duties as assigned.
• Occasional travel required for team events to support engagement, relationship-building, and key decision-making.

Qualifications

• 4+ years of IT risk assessment and/or IT audit experience to include reading and interpreting the results of audit reports (SOC 1, SOC 2, etc.), security assessments (penetration tests, vulnerability scans, etc.), and continuity exercises (disaster recovery, security incident, etc.)
• Bachelor's degree in Information Systems, Risk Management, Business Administration, Accounting, or a related field.
• Working knowledge of information security standards and laws (e.g., NIST, FFIEC, GLBA, etc.), and commonly used concepts, practices and procedures within the information security and privacy field.
• Experience supporting IT risk management, information security, internal audit, compliance, or third-party risk management programs.
• Excellent communication skills and be able to write, speak and present to all levels of management.
• Strong organizational ethic to manage a large volume of competing tasks effectively.
• Professional certification, such as CRVPM, TPCRA, CISA, or CRISC, are preferred.

Benefits

• Market competitive total rewards package
• To be part of the Heart & SOUL of a winning company with an inspiring mission
• The opportunity to Make Big Things Happen
• Competitive salary and bonus structure along with full health benefits with an HSA option
• Flexible PTO and bank holidays
• 401(k) plan and company match

Company Description

We are an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender identity, age, genetic trait, sexual orientation, national origin, disability status, or any other characteristic protected by law.

Abrigo is committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, you may contact us at [email protected] with the subject line accommodation.