Tech Risk – Third Party Risk Management

• Drive the evolution of AT&T's Technology Third Party Risk Management program, including processes to identify, assess, mitigate, monitor, and report technology third-party risks
• Advise on the design and enhancement of foundational TPRM capabilities, including policies and standards, third-party inventory, risk tiering, due diligence, onboarding, monitoring, and termination activities
• Evaluate program maturity and lead improvement initiatives across governance, processes, controls, technology enablement, and data management capabilities
• Partner with stakeholders across Supply Chain, Enterprise Risk Management, Compliance, Technology, and Legal to advance strategic program objectives and strengthen risk management practices
• Develop executive-level risk assessments, point-of-view documents, and escalation materials related to critical third parties, emerging risks, and program gaps
• Serve as a trusted advisor to business units on emerging third-party risk topics, regulatory developments, and industry best practices

• 7+ years experience in multiple industry risk, control, and governance disciplines (e.g., Audit, Information Security, and Regulatory Compliance)
• 5+ years of work experience in third party risk management and/or supply chain processes at a global company with strong understanding of technology products, services, and life cycles
• Strong presentation and executive oral/written communication skills with demonstrated experience leading culture and capabilities change across a diverse set of stakeholder groups
• Experience designing, implementing, and sustaining programs that effectively manage risk throughout the risk management lifecycle, including:
  Strategic technology risk advisory
• Risk identification, including emerging risks
• Maturity and risk assessment, scenario analysis
• Risk response, mainly issue remediation
• Risk monitoring
• Policy and committee governance
• Demonstrated success in remediating self-identified, internal / external audit, and regulatory / compliance issues with proven ability to shape and solve complex problem statements
• Extensive knowledge of information and technology risk management policies, methods, standards, tools, and processes (e.g., ISO, COSO, COBIT, NIST) as well as knowledge of compliance, legal, internal / external audit & regulatory requirements

Demonstrates extensive expertise in Third Party Risk Management, including risk identification, assessment, and mitigation, while effectively collaborating with stakeholders across various functions to enhance governance and compliance practices.

• Third Party Risk Management
• Risk Identification
• Risk Assessment
• Regulatory Compliance
• Information Security

• Risk Management Lifecycle
• Risk Monitoring
• Policy Governance
• Scenario Analysis
• Issue Remediation
• Audit Management
• Technology Risk Advisory
• Due Diligence
• Risk Tiering
• Data Management

• Executive Communication
• Presentation Skills
• Stakeholder Engagement
• Problem Solving
• Change Management

• Governance
• Supply Chain
• Compliance
• Internal Audit
• External Audit

• ISO Standards
• COSO Framework
• COBIT Framework
• NIST Standards