Third-Party Risk Consultant

About the role

MassMutual is hiring a Third-Party Risk Consultant for its ETX Governance, Risk & Compliance team in Springfield/Boston. The consultant helps implement the third-party technology risk framework and runs risk assessments and due diligence across MassMutual's third-party ecosystem, working with U.S., Romanian and Indian colleagues in a globally distributed team.

Key responsibilities

• Analyze third-party services, data flows and system integrations to identify inherent and residual risk exposure
• Work with issue management teams so that risks and vulnerabilities are tracked, communicated and remediated
• Contribute to status reporting and metrics tracking for third-party risk activities
• Evaluate, document and support breach event and incident response activities
• Review evidence, document observations and record results using defined templates and quality standards
• Identify control gaps, weaknesses or non-compliance issues and document findings
• Support risk rating determinations and escalation decisions, and partner with senior practitioners
• Assess third parties against security and technology standards, and escalate delays, information gaps or emerging risks to the team lead
• Consult internal subject matter experts, respond to leadership feedback and support onboarding, knowledge transfer and process adoption

Required profile

• 2+ years of experience in risk management and/or completing third-party risk assessments
• 2+ years of experience implementing metrics to track status, identify trends and surface issues
• Ideal: associate's degree in technology, cybersecurity, risk management or a business-related field
• Ideal: 3+ years in third-party risk, technology risk, cybersecurity, audit or controls testing
• Ideal: experience in a contract, consulting, managed services or globally distributed team

Required skills

• Enterprise GRC platform, with proficient Excel import/export
• Ideal: SharePoint and familiarity with NIST, ISO 27001, SOC 2 or similar frameworks
• Ideal: ability to explain regulatory requirements to technical and non-technical audiences

Salary range: $86,200-$113,100.