Join EY and build a unique career in a supportive, inclusive, and global environment. As an AI Third Party Risk Analyst, you will be instrumental in strengthening our cyber risk and compliance efforts. This entry-level role offers a fantastic opportunity to immerse yourself in third-party security assessments and vendor due diligence processes, applying foundational knowledge of TPRM frameworks and AI security principles. You'll gain hands-on experience across the entire third-party risk management lifecycle, from onboarding to AI-assisted monitoring.

This position is perfect for individuals eager to develop core competencies in cybersecurity, regulatory compliance, and data-driven risk evaluation within a dynamic team. We are seeking driven individuals ready to contribute to building a better working world through robust risk management.

Your responsibilities will encompass supporting comprehensive Third-Party Security Assessment (TPSA) activities, including vendor intake, initial risk screening, and evaluating assessor adherence to industry standards. You will assist in vendor due diligence by meticulously collecting and validating security evidence and questionnaire responses. A key part of this role involves evaluating AI security practices of third parties and participating actively in the risk assessment lifecycle from onboarding through ongoing monitoring.

Key duties include maintaining and updating TPRM risk registers and vendor risk profiles within GRC tools. You'll support supply chain risk identification by flagging vendors with elevated exposure across IT, cloud, and operational domains. Leveraging AI-enabled solutions for automated analysis, gap identification, and risk treatment plan generation will be crucial. Tracking vendor remediation progress and ensuring compliance with internal policies and regulatory standards like ISO 27001 and NIST CSF are also vital components of this role.

To excel in this role, you should possess 1-4 years of experience in cyber risk, third-party risk, or information security. A foundational understanding of Third-Party Risk Management (TPRM) frameworks, vendor assessment processes, and the risk assessment lifecycle is essential. Familiarity with cybersecurity standards such as ISO 27001, NIST CSF, SOC 2, and CIS Controls is required, along with knowledge of AI governance standards like ISO 42001 and an understanding of AI security in third-party contexts.

We are looking for candidates with the ability to review and validate vendor security questionnaires and proficiency in MS Office tools for risk tracking and reporting. Strong analytical thinking, attention to detail, and excellent written communication skills are paramount. A Bachelor’s degree in Engineering, Technology, Business, Risk Management, or a related discipline is required. Relevant certifications are advantageous.