At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all.
Staff – AI Third Party Risk Analyst (Third Party Security Assessment)
Experience: 1–4 Years
Role Summary
The AI Third Party Risk Analyst is an entry-level role responsible for supporting the execution of Third-Party Security Assessments (TPSA) and Vendor Due Diligence processes. The analyst works within the Cyber Risk and Compliance team, applying foundational knowledge of third-party risk management (TPRM) frameworks, supply chain security principles, AI security for third parties and use of AI-enabled tools for Third Party Security Assessment. This role provides exposure to third party risk management lifecycle, onboarding assessment, and AI-assisted assessment & monitoring capabilities while building core competencies in cybersecurity, regulatory compliance, and data-driven risk evaluation.
Key Responsibilities
- Support end-to-end Third-Party Security Assessment (TPSA) activities including vendor intake, initial risk screening, assessor evaluation against industry specific standards/regulations and documentation of assessment findings.
- Assist in conducting vendor due diligence reviews by collecting, reviewing, and validating vendor-provided security evidence and questionnaire responses.
- Evaluate AI security practices of third parties wherever applicable.
- Participate in the risk assessment lifecycle from vendor onboarding through ongoing monitoring, escalation, and offboarding.
- Maintain and update TPRM risk registers, risk logs, and vendor risk profiles in GRC tools or risk management platforms.
- Support supply chain risk identification activities by flagging vendors with elevated exposure across IT, cloud, and operational domains.
- Assist senior team members in preparing risk assessment reports, dashboards, and executive summaries.
- Use and implement AI-enabled solutions for automated questionnaire/evidence analysis, gap identification, issue description and identification of risk treatment plans to accelerate risk evaluation.
- Track vendor remediation progress against identified control gaps and support follow-up activities.
- Maintain compliance with internal policies, regulatory standards (e.g., ISO 27001, NIST CSF, SOC 2 and more), and sector-specific requirements.
- Contribute to continuous improvement of TPRM workflows, templates, and assessment methodologies.
Education / Certifications
- Bachelor’s degree in engineering, Technology, Business, Risk Management, or related discipline.
- Relevant certifications are advantageous (e.g., CompTIA Security+, ISO 27001 , ISO 42001, CISA, CISM, CISSP, other TPRM certifications).
AI & Cyber Certifications
Cyber Security Certifications (Required / Advantageous):
- CompTIA Security+ – Foundational cybersecurity knowledge covering threats, vulnerabilities, and risk management.
- ISO/IEC 27001 Foundation – Understanding of Information Security Management System (ISMS) principles.
- Certified in Risk and Information Systems Control (CRISC) – Entry-level awareness of IT/cyber risk concepts (pursuing).
AI & Data Certifications:
- Microsoft Azure AI Fundamentals (AI-900) – Foundational understanding of AI/ML concepts on cloud platforms.
- Google Cloud Digital Leader – Awareness of AI and cloud services applicable to risk assessment contexts.
- IBM AI Foundations for Business – Introduction to AI concepts including machine learning and automation.
- Coursera / edX AI for Everyone (Andrew Ng) – Broad awareness of AI applications in business and risk management.
Skills & Experience
Required Skills:
- 0–4 years of experience in cyber risk, third-party risk, information security, or related field.
- Basic understanding of Third-Party Risk Management (TPRM) frameworks and vendor assessment processes.
- Familiarity with risk assessment lifecycle stages: identification, evaluation, mitigation, monitoring, and reporting.
- Knowledge of cybersecurity standards such as ISO 27001, NIST CSF, SOC 2, and CIS Controls.
- Knowledge of AI governance standards as ISO 42001. Understanding of AI security, especially in context of third-party security.
- Understanding of supply chain risk concepts including vendor tiering and dependency mapping.
- Ability to review and validate vendor security questionnaires (e.g., SIG, CAIQ, custom questionnaires).
- Proficiency in MS Office tools (Excel, PowerPoint, Word) for risk tracking and reporting.
- Strong attention to detail, analytical thinking, and written communication skills.
Good to Have Skills (including AI):
- Exposure to GRC platforms (e.g., ServiceNow GRC, Archer, OneTrust, ProcessUnity) for risk tracking.
- Awareness of AI-enabled risk scoring tools and automated vendor intelligence platforms (e.g., BitSight, Security Scorecard, RiskRecon).
- Basic understanding of predictive modelling concepts applied to vendor risk prioritization.
- Familiarity with AI-driven questionnaire automation and NLP-based document analysis tools.
- Exposure to data analytics tools such as Excel Power Query, Power BI, or similar for risk dashboards.
- Interest in emerging AI technologies including machine learning applications in cyber risk management.
- Awareness of Graph AI concepts for mapping vendor relationships and supply chain dependencies.
AI Tools Skillset
Vendor Risk & Scoring Tools:
- BitSight / Security Scorecard / RiskRecon – Awareness and basic navigation for vendor cyber ratings and continuous monitoring signals.
- GRC Tools – Familiarity with vendor risk management workflow tools for questionnaire tracking and risk registers.
GRC & Automation Platforms:
- ServiceNow GRC – Basic usage for risk logging, vendor profiles, and assessment task management.
- Microsoft Power Automate – Introductory exposure to workflow automation for risk data collection and notifications.
Data Analytics & Reporting:
- Microsoft Excel (Power Query, Pivot Tables) – Risk data aggregation, vendor scoring worksheets, and basic dashboard creation.
- Microsoft Power BI – Consuming pre-built risk dashboards and understanding risk KPIs.
AI Awareness Tools:
- ChatGPT / Microsoft Copilot – Basic use for summarizing vendor documentation, drafting risk findings, and accelerating report writing.
- Bing AI / Google Gemini – Research assistance for vendor background checks and regulatory lookups.
Behavioral Expectations
- Deliver assigned modules with quality and timeliness.
- Collaborate effectively across teams and stakeholders.
- Demonstrate learning agility in AI and cyber risk domains.
- Support continuous improvement and automation initiatives.
- Show curiosity and proactively develop skills in AI-enabled risk management.
- Maintain professionalism and confidentiality in handling sensitive vendor information.
EY | Building a better working world
EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.
Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate.
Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.