IT&Data CS 3rd Party Risk Mgt

Job Description:

• Position Overview
• The Third Party Cyber Risk Manager is tasked with overseeing cybersecurity risks linked to suppliers, vendors, service providers, outsourcing partners, and strategic business allies.
• This role guarantees that cybersecurity risks are identified, assessed, monitored, reported, and mitigated throughout the lifecycle of third-party relationships.
• This position collaborates closely with Procurement, Legal, Information Security, Compliance, Risk Management, and Business stakeholders to develop and uphold a robust Third Party Risk Management (TPRM) program that aligns with industry standards, regulatory mandates, and organizational security goals.

Key Responsibilities:

• Primary Duties
• Third Party Risk Management
• Enhance and continuously refine the Third Party Risk Management (TPRM) framework.
• Establish, execute, and uphold vendor cyber risk assessment methodologies, processes, and standards.
• Conduct cybersecurity risk assessments for suppliers and vendors.
• Perform due diligence evaluations for both new and existing third parties.
• Carry out vendor risk classification and tiering operations.
• Review and evaluate vendor security questionnaires and related documentation.
• Verify the cybersecurity measures implemented by external vendors and service providers.
• Identify, document, and assess cybersecurity risks associated with third-party relationships.
• Monitor remediation plans and track the closure of identified risks and control deficiencies.
• Conduct periodic vendor reassessments and ongoing risk evaluations.
• Continuously monitor third-party risks through ongoing assessment and risk monitoring activities.
• Assist with vendor onboarding, continuous governance, and offboarding processes.
• Collaborate with Procurement, Legal, Compliance, and Information Security teams throughout the vendor lifecycle.
• Support audits, compliance assessments, and regulatory reporting efforts.
• Create and maintain risk dashboards, KPIs, metrics, and executive reporting.
• Present risk findings and recommendations to senior stakeholders and governance committees.
• Governance, Risk, Compliance
• Maintain comprehensive inventories of third-party risks and risk registers.
• Assist in risk acceptance, exception management, and remediation governance processes.
• Contribute to cybersecurity governance and assurance initiatives.
• Support the development of policies, standards, and procedures related to third-party cybersecurity risk.
• Advise business teams on vendor security requirements and risk mitigation strategies.
• Assurance Reviews
• Evaluate and review
• o ISO 27001 Certifications
• o SOC 1 Reports
• o SOC 2 Reports
• o PCI DSS Attestations
• o Penetration Test Reports
• o Internal Audit Reports
• o Security Policies and Procedures
• Emerging Risk Areas
• Artificial Intelligence (AI) Vendor Risk
• Software Supply Chain Risk
• Cloud Concentration Risk
• Fourth Party Risk Management
• ICT and Critical Supplier Risk
• Operational Resilience and Outsourcing Risk

Technical Requirements:

• Essential Skills and Competencies: Must Have
• Third Party Risk Management
• Extensive expertise in Third Party Risk Management (TPRM), Vendor Risk Management (VRM), Supplier Risk Management, Outsourcing Risk, ICT Risk, and Operational Resilience.
• Experience across the entire third-party lifecycle.
• Practical experience in conducting vendor due diligence reviews.
• Familiarity with security questionnaires and supplier assessments.
• Knowledge of control assessments and evidence validation.
• Experience supporting contract negotiations from a cybersecurity and risk viewpoint.
• Strong grasp of risk identification, analysis, rating, and remediation tracking.
• Experience reviewing ISO 27001 certifications and SOC 2 reports.
• Cybersecurity Risk Assessment
• In-depth knowledge of cybersecurity and information risk management.
• Experience applying frameworks and standards such as
• o ISO 27001
• o NIST Cybersecurity Framework (CSF)
• o NIST 800 Series
• o SOC 2
• o Vendor Security Control Frameworks
• Comprehension of security governance, risk management, and compliance principles.
• Stakeholder Management
• Strong skills in stakeholder engagement and relationship management.
• Ability to effectively collaborate with Procurement, Legal, Compliance, Security, Audit, and Business teams.
• Excellent analytical, written, verbal, and presentation skills.
• Capacity to evaluate assessment quality and exercise sound risk judgment.
• Essential Skills and Competencies: Good to Have
• Familiarity with GRC and TPRM platforms such as
• o ServiceNow GRC
• o OneTrust
• o SecurityScorecard
• o BitSight
• Understanding of privacy and regulatory frameworks like GDPR and NIS2.
• Experience in procurement and vendor management.
• Skills in executive presentation and reporting.
• Experience with continuous monitoring solutions and cyber risk intelligence platforms.
• Knowledge of cloud security and software supply chain risk management.
• Experience Qualifications
• Experience
• Total Experience: 5-8 Years
• Relevant Experience: 3-5 Years in
• o Third Party Risk Management (TPRM)
• o Vendor Risk Management (VRM)
• o Cyber Risk Management
• o Information Security Risk
• o Security Governance, Risk, Compliance (GRC)
• o Operational Risk Management

Preferred Skills:

Domain->Risk Services->Vendor Risk Management,Technology->Cloud Security->GCP - GRC,Technology->Cloud Security->AWS - GRC