GRC Associate – Third-Party Risk Management

Job Description

Associate, Global Risk and Compliance – Global Capability Center | Alvarez & Marsal

The Tone:
This is a full-time Associate role at Alvarez & Marsal, located in the Global Capability Center. Alvarez & Marsal is a global consulting firm that takes a hands-on approach to solving client problems and assisting them in reaching their potential. This role is critical for managing and enhancing the firm’s third-party risk management program, ensuring compliance with regulatory requirements and internal security policies. The successful candidate will play a key part in assessing, monitoring, and mitigating risks associated with third-party vendors.

The TL;DR
• Role: Full Time
• Type: Full-time
• Location: In-person, Global Capability Center

• Team: Aligns to the team responsible for third-party risk management.
• Mission: Manages and enhances the firm’s third-party risk management program, ensuring compliance and mitigating risks associated with third-party vendors.
• Tech Stack: GRC platforms and tools

What You’ll Actually Do
• Third Party Risk Management: Identify vendor risks, produce and deliver comprehensive due diligence and risk assessments, and execute vendor assessments within defined SLAs.
• Client Security Questionnaires: Manage and complete client security questionnaires and assessments within defined SLAs, collaborating with internal teams to gather accurate responses.
• Contract Reviews: Evaluate security terms in client and vendor contracts to mitigate risks and ensure alignment with organizational security policies and compliance requirements.
• Risk Reporting & Communication: Communicate identified risks and remediation strategies to both technical and non-technical stakeholders, and participate in governance activities including metrics gathering and reporting.
• Continuous Improvement: Suggest and implement process improvements for GRC activities, including the use of Artificial Intelligence and automation.

The Must-Haves
• Background: Bachelor’s degree in Information Security, Risk Management, Business, or a related field.
• Experience: 3-5 years of experience in GRC, third-party risk management, or information security, including conducting vendor risk assessments and audits, managing client security questionnaires, and reviewing security clauses in legal contracts.
• Skills: Excellent analytical, problem-solving, and decision-making skills; strong communication and interpersonal skills; and the ability to translate security risks into business-accessible language and format.
• Bonus: Industry recognized certification in security such as CRISC, CTPRP, CISSP, or CISM; familiarity with third-party risk management tools and platforms; knowledge of information security regulatory requirements; and a good understanding of security frameworks like ISO 27001 and NIST.