Specialist- Technology Services

Specialist - IT TPCRM

The Opportunity

The Specialist - IT TPCRM is responsible for coordinating and executing activities associated with MetLife’s Global IT Third-Party Risk Management (TPRM) Program within the IT Risk & Security organization. This role supports the identification, assessment, monitoring, and mitigation of technology and security risks associated with third-party vendors across MetLife's global operations.

Guided by MetLife's purpose of helping people pursue more from life and aligned with our commitment to risk management excellence, this role provides an exciting opportunity to work at the intersection of cybersecurity, vendor governance, and enterprise risk management. The position offers exposure to senior stakeholders, global vendors, and critical security initiatives while driving meaningful improvements to MetLife's overall security posture.

Key Responsibilities

• Lead third-party vendor risk assessments and security evaluations across technology vendors and service providers.
• Create comprehensive risk assessment reports, findings documentation, risk recommendations, and remediation tracking mechanisms.
• Oversee the end-to-end vendor assessment lifecycle, including risk identification, analysis, follow-up, and closure of findings.
• Manage vendor relationships and coordinate remediation activities, action plans, and due date negotiations.
• Develop and enhance third-party risk management processes, controls, and assessment methodologies.
• Coordinate with internal stakeholders, senior management, and external vendors to ensure compliance with security and regulatory requirements.
• Perform reviews of audit reports (SSAE18, SOC, PCI ROC, etc.), penetration testing reports, vulnerability assessments, and other security artifacts.
• Provide guidance on IT security requirements during contract review and vendor onboarding discussions.
• Serve as a subject matter expert on information security risks, controls, mitigation strategies, and industry best practices.
• Support continuous improvement initiatives by researching emerging technologies, threats, security standards, and regulatory requirements.

Required Qualifications

• Bachelor's degree in Computer Science, Information Systems, MIS, Information Security, or a related technical discipline.
• 3-5 years of experience in IT Risk Management, Information Security, IT Audit, Vendor Risk Management, or related fields.
• Strong understanding of information security frameworks, standards, and regulations including ISO 27001, ISO 27002, PCI-DSS, and related industry practices.
• Experience reviewing and interpreting audit and compliance reports such as SSAE18/SOC reports, PCI ROC, penetration test reports, and vulnerability assessments.
• Understanding of third-party/vendor risk assessment methodologies and technology risk management processes.
• Excellent verbal, written, presentation, and stakeholder management skills with the ability to interact effectively at all organizational levels.
• Knowledge of information security concepts, controls, risk mitigation strategies, and governance practices.
• Strong analytical, organizational, and problem-solving capabilities with the ability to manage multiple priorities.
• Proficiency in Microsoft Office tools and enterprise collaboration platforms such as SharePoint.
• Familiarity with AI-enabled security risks, emerging cybersecurity threats, and technology risk assessment practices.

Preferred Qualifications

• Professional certifications such as CISA, CRISC, CISSP, or equivalent security/risk certifications.
• Experience with Aravo or similar Third-Party Risk Management (TPRM) platforms.
• 3-5 years of experience performing vendor risk assessments, IT audits, security assessments, or compliance evaluations.
• Experience working with global stakeholders and external vendors in a fast-paced, results-driven environment.
• Demonstrated ability to conduct deep-dive investigations and analyze information security risks.
• Strong adaptability, accountability, and continuous learning mindset.
• Experience presenting risk findings and recommendations to senior leadership.
• Ability to drive process improvements and provide value-added recommendations to enhance third-party risk governance.

Working Relationships

Internal Contacts

• IT Risk & Security teams
• Information Technology teams
• Procurement and Vendor Management teams
• Legal and Compliance teams
• Business Unit stakeholders

Senior Management

External Contacts

Third-Party Vendors

Technology Service Providers

External Auditors and Assessment Partners