About the Role
Role Summary
The Senior Risk Analyst – Privacy & Third-Party Risk is a Second Line of Defense (2LoD) role and a member of the Global Privacy Office (GPO) and Third-Party Risk Management (TPRM) function. The role provides independent risk oversight, effective challenge, and assurance over first-line activities and outsourced TPRM services, operating with minimal supervision and a high degree of professional judgment.
This position is expected to independently manage complex risk assessments, lead oversight activities, identify emerging risk themes, and deliver clear, actionable insights to senior stakeholders and governance committees. The role also supports the effective operation and continuous improvement of the GPO and TPRM programs through risk reporting, data analysis, issue management, technology enablement, and maintenance of core governance and compliance processes.
Requirements
Qualifications
Required:
- Bachelor’s degree in Risk Management, Information Systems, Finance, Business, Law, or a related field.
- 5+ years of experience in risk management, GRC, information security, privacy, third-party risk, operational risk, technology risk, or a related oversight function, preferably within financial services, asset management, or another highly regulated industry.
- Demonstrated ability to operate independently with minimal guidance in a 2LoD environment or in a risk function requiring independent review, challenge, and escalation.
- Strong knowledge of risk management principles and demonstrated expertise in one or more relevant domains, such as privacy, third-party risk, information security, technology risk, operational risk, or compliance, with the ability to develop expertise across both Privacy and TPRM.
- Demonstrated experience identifying control weaknesses, assessing risk, developing or challenging remediation plans, and communicating findings to stakeholders.
- Strong analytical skills and experience working with risk data, metrics, reporting, or management information.
Preferred:
- Experience leading or independently managing 2LoD privacy or TPRM oversight activities.
- Asset management or broader financial services experience.
- Experience spanning multiple risk domains, such as operational risk, information security, technology risk, privacy, resiliency, compliance, or third-party risk.
- Experience with control testing, risk and control assessments, issue management, root cause analysis, remediation oversight, or similar risk-management activities.
- Experience supporting or implementing risk-management frameworks, policies, standards, or program enhancements.
- ISO 27001 Lead Implementer, Auditor, or other relevant risk, security, privacy, or third-party risk certifications.
- Familiarity with SEC, FINRA, and global regulatory expectations.
Tools & Technology – Preferred
- Advanced experience with GRC, privacy, and TPRM platforms (e.g., Archer, ServiceNow, OneTrust, IBM OpenPages).
- Strong proficiency with reporting and analytics tools (e.g., Power BI, advanced Excel).
- Practical experience using AI-enabled risk, compliance, or data analytics tools to enhance oversight and reporting (e.g., Microsoft Copilot, ChatGPT Enterprise).
- Ability to automate reporting and improve risk visibility.
- Experience developing business requirements, user stories, test scenarios, or performing UAT for risk-management technology solutions is preferred.
- Familiarity with workflow and automation tools such as Power Automate or similar technologies is a plus.
Certifications
Relevant professional certification or demonstrated equivalent experience preferred. Candidates actively pursuing a relevant certification will also be considered. Examples include:
- Certified Information Privacy Professional (CIPP/US, CIPP/E)
- Certified Information Systems Auditor (CISA)
- Certified in Risk and Information Systems Control (CRISC)
- Certified Third Party Risk Professional (CTPP/CTPRP)
- Certified Information Privacy Manager (CIPM)
- Certified Information Privacy Technologist (CIPT)
Key Competencies
- Strong independent judgment and risk-based decision-making.
- Ability to provide credible, effective challenge at senior levels.
- Excellent written and verbal communication skills.
- Strong issue management, quality assurance, and governance discipline.
- Comfort operating autonomously in a global, regulated environment.
- Ability to manage both complex analytical work and recurring operational responsibilities with accuracy and discipline.
- Strong stakeholder-management skills and ability to collaborate across business, Technology, Information Security, Legal, Compliance, Procurement, and other risk functions while maintaining appropriate 2LoD independence.
- Continuous-improvement mindset with the ability to translate risk-management needs into practical process and technology enhancements.
FINRA Requirements
FINRA licenses are not required and will not be supported for this role.
About the Company
T. Rowe Price is a premier global asset management organization, actively investing in opportunities to help people thrive in an evolving world.
Headquartered in Baltimore, Maryland, we provide a broad range of investment solutions across equity, fixed income, and multi-asset capabilities for clients around the world—from individuals to advisors to institutions to retirement plan sponsors.
Our active, independent investing approach has guided how we do business for more than 85 years. Our professionals have diverse perspectives, but are united behind a commitment to rigorous research. They collaborate to identify market risks and opportunities that can give clients sharper insights and an investment edge. We maintain a long-term view, aiming to deliver consistently strong performance in up and down markets.
Our clients—and their success—are our singular focus. That’s why we build deep, meaningful partnerships, matching client goals with our expertise. By understanding clients’ needs and delivering timely, actionable insights and solutions, we can help them navigate change and achieve better outcomes.