TPRM Security Risk Analyst

The Third Party Risk (TPRM) Analyst supports the delivery and day-to-day operation of APRA's Third-Party Risk Management capability. Working closely with the Third Party Risk Manager, the role is responsible for coordinating, conducting and administering third-party security, Foreign Ownership, Control or Influence (FOCI), privacy, operational resilience and AI-related risk assessments across new procurements, contract renewals and existing supplier arrangements. The role serves as a key delivery resource within the TPRM function and is responsible for assessment coordination, evidence collection and review, supplier engagement, risk documentation, reporting, workflow administration and continuous monitoring activities. The incumbent works closely with internal stakeholders and suppliers to ensure assessments are progressed efficiently while maintaining compliance with APRA's governance, security and risk management requirements. The role combines strong stakeholder engagement, analytical capability and attention to detail to support informed third-party risk decisions and maintain a robust audit trail throughout the supplier lifecycle. Key duties and responsibilities Third-Party Risk Assessment Delivery Assist the Third Party Risk Manager with the design, documentation, implementation and continuous improvement of APRA's Third-Party Risk Management Framework. Support the development of policies, SOPs, assessment methodologies, vendor tiering criteria, questionnaires, workflows, reporting processes, governance artefacts and the Vendor Risk Register, ensuring the framework remains aligned with PSPF, ISM, FOCI guidance, AI governance requirements and industry best practice. Undertaking Third-Party Risk Assessments (TPRAs) in accordance with APRA's TPRM Framework, methodologies and operating procedures, covering Information Security, FOCI, AI and Privacy risks for new procurements, contract renewals and material supplier changes. Review assessment outputs generated by the TPRM platform and validate findings against supplier-provided evidence Apply APRA's vendor tiering model and determine assessment requirements based on supplier risk characteristics. Prepare risk assessment reports, findings summaries and recommendations for review by the TPRM Manager and Risk Owners. Coordinate assessment workflows from initiation through endorsement, ensuring assessments are completed within agreed service levels and supported by appropriate evidence. Review supplier responses, supporting documentation and security artefacts to identify potential control gaps, risks and areas requiring further clarification. Assist the TPRM Manager in preparing assessment summaries, risk recommendations and stakeholder decision papers. Maintain assessment records, evidence repositories and audit trails in accordance with APRA's governance and recordkeeping requirements. Criteria The buyer has specified that each candidate must provide a one page pitch to address all criteria specified. This is equal to 5000 characters. Essential criteria 1. Relevant personnel security capability and delivery approach 2. Quality, experience and suitability of proposed Personnel Security specialist 3. Governance, compliance, privacy and delivery assurance 4. Pricing and Value for money Opportunity summary Sellers can submit Up to 3 candidates Number of sellers invited Fewer than 5 Number of candidates submitted Fewer than 10 Send us feedback About Accessibility Privacy Terms of use Disclaimer and copyright An initiative of the Digital Transformation Agency The Australian Government acknowledges the Traditional Owners of Country throughout Australia and acknowledges their continuing connection to land, waters and community. We pay our respects to the people, the cultures and the Elders past and present. © Commonwealth of Australia