Third-Party Risk Analyst II (Information Systems Analyst II, Opt. S)

Essential Functions

• Under administrative direction, serves as a Third-Party Risk Analyst II for the Department of Innovation & Technology (DoIT) performing complex professional and advisory functions in System Services and advanced professional assignments in support of the Third-Party Risk Management (TPRM) program.
• Supports the advancement of the Third-Party Risk Management (TPRM) program by enhancing tools, frameworks, processes, and documentation to drive consistency and effectiveness.
• Collaborates on highly complex team initiatives and contributes to cross-functional efforts supporting Governance, Risk, & Compliance (GRC) objectives.
• Monitors third-party threats and evolving regulatory expectations to support risk awareness and enhance satiation awareness across the organization.
• Keeps abreast of new developments in the information technology field by continuing education through online training platforms, meetings, training sessions, seminars, and conferences to increase familiarity with and remain current on products, vendors, techniques, and procedures.
• Performs other duties as required or assigned which are reasonably within the scope of the duties enumerated above.

Minimum Qualifications

• Requires knowledge, skill, and mental development equivalent to four (4) years of college with coursework in computer science or directly related fields. 
• Requires three (3) years of professional experience in System Services or a related Information Technology field. 

Specialized Skills

• Requires three (3) years of professional experience conducting detailed third-party risk reviews (e.g., SOC 2 Type 2 analysis) or directly related experience applying relevant regulatory and cybersecurity standards to evaluate controls, identify vulnerabilities, and assess risks to sensitive data.
• Requires three (3) years of professional experience utilizing and implementing the ServiceNow IRM suite of modules to support governance, risk, and compliance activities.
• Requires three (3) years of professional experience leading or contributing to the development or continuous improvement of third-party risk management playbooks, assessment templates, or standard operating procedures, including training or change management efforts to promote adoption and consistency.
• Requires one (1) year of professional experience implementing, managing, and leading automation and process improvement initiatives within the ServiceNow Third-Party Risk Management module, including assessment workflows and enhanced risk analysis automation.

Preferred Qualifications (In Order of Significance)

• Three (3) years of professional experience conducting detailed third-party risk reviews (e.g., SOC 2 Type 2 analysis), or related position(s) applying relevant regulatory and cybersecurity standards to evaluate controls, identify vulnerabilities, and assess risks to sensitive data.
• Three (3) years of professional experience utilizing and implementing the ServiceNow IRM suite of modules to support governance, risk, and compliance activities.
• Three (3) years of professional experience leading or contributing to the development or continuous improvement of third-party risk management playbooks, assessment templates, or standard operating procedures, including training or change management efforts to promote adoption and consistency.
• One (1) year of professional experience implementing, managing, and leading automation and process improvement initiatives within the ServiceNow Third-Party Risk Management module, including assessment workflows and enhanced risk analysis automation.
• Three (3) years of professional experience analyzing and effectively communicating complex third-party risk issues, findings, and mitigation strategies to both technical and non-technical stakeholders through written documentation and verbal briefings.  
• Demonstrated ability to adapt third-party risk processes and frameworks in response to emerging threats, changes in regulatory requirements, or evolving business needs.
• Ability to gain and maintain effective cross-functional working relationships and collaborate with vendors, clients, legal, procurement, or other business units to align third-party risk assessments with contract requirements, onboarding, procurement workflows, and governance objectives.
• Working knowledge of control frameworks, to include (NIST 800-53, NIST 800-161, and ISO 27001), with demonstrated application of these frameworks to vendor security evaluations and regulatory compliance.
• Working knowledge of the State of Illinois Information Security Program, procurement processes, and other similarly relevant compliance obligations related to vendor oversight and third-party risk management.
• Certified Information Systems Auditor (CISA), Certified Third-Party Risk Assessor (CTPRA), Certified in Risk and Information Systems Control (CRISC), or equivalent.  

Conditions of Employment

NOTE: Applicants must possess the ability to meet ALL of the following conditions of employment, with or without reasonable accommodation, to be considered for this position.

• Requires the ability to verify identity and requires employment authorization to accept permanent full-time position with the State of Illinois.
• Requires the ability to pass a position specific, agency required background check and requires self-disclosure of criminal history. 
• Requires the ability to travel in the performance of duties.
• Requires the ability to work outside of normal hours to meet deadlines and requires the ability to work overtime including scheduled, unscheduled, short notice, evening, weekends, and holidays.
• Requires the ability to use agency supplied equipment such as laptop, personal computer, work cell phone, etc. 
• Requires the ability to attend seminars, conferences, and training to remain current on methods, tools, ideologies, or other industry related topics relevant to job duties. 
• Requires the ability to lift and carry objects or equipment weighing up to 10 pounds. This is considered sedentary work as defined by the U.S. Department of Labor (20 CFR 404.1567(a)). Sedentary work involves lifting no more than 10 pounds at a time and requires occasional lifting, carrying, walking, and standing. 
• Requires adherence to the revolving door restrictions outlined in 5 ILCS 430/5-45. Consequently, employees should be aware that in the event of receiving a non-State employment offer during state employment or within one year immediately following the termination of State employment, they are required to inform the Office of the Executive Inspector General for the Agencies (OEIG) of the Illinois Governor before accepting such non-State employment. Failure to notify the OEIG may result in the imposition of a fine. 
• Requires compliance with the provisions outlined in section 4A-101 of the Illinois Governmental Ethics Act, necessitating the occupant of this position to file of a Statement of Economic Interest. Pursuant to the Illinois Governmental Ethics Act (5 ILCS 420/4A et seq.), specific state officials and employees are required to annually submit Statements of Economic Interest to the Office of the Secretary of State, which will be accessible to the public for examination and copying. Employees subject to this requirement must also file a Supplemental Statement of Economic Interest with the Executive Ethics Commission, as specified in Executive Order 15-09. Failure to submit these statements in a timely manner may result in fines and penalties.
• The conditions of employment listed are incorporated and/or related to any duties included in the position description.