Job Overview

We are seeking a highly skilled and motivated Vendor Information Security Risk Management Specialist to join our team. This individual will be responsible for evaluating and tracking information security risks posed by third-party vendors and partners. As part of the G&C team, you will collaborate with various stakeholders to ensure the integrity, confidentiality, and availability of our data and systems when interacting with external entities.

Key Responsibilities

Vendor Risk Assessments: Conduct comprehensive information security risk assessments on third-party vendors and service providers. Evaluate their security posture, identify vulnerabilities, and ensure compliance with company policies, industry standards, and legal/regulatory requirements.
Risk Mitigation & Management: Collaborate with stakeholders to define risk mitigation strategies for third-party vendors. Monitor and manage the lifecycle of vendor risk and ensure that risk treatment plans are in place and executed.
Compliance & Regulatory Oversight: Ensure that third-party vendors comply with relevant industry standards (e.g., GDPR, ISO 27001, SOC 2, etc.) and internal security policies.
Contractual Security Requirements: Work closely with the legal and procurement teams to establish and enforce security terms in third-party contracts, including Service Level Agreements (SLAs) and Data Processing Agreements (DPAs).
Continuous Monitoring: Implement processes and tools for ongoing monitoring of third-party security posture. Evaluate third-party security reports, incident response, and performance metrics to ensure adherence to agreed-upon security controls.

Experience:

Minimum of 6 years of experience in information security, risk management, or a related field, with a focus on third-party risk management.
Demonstrated experience in assessing and mitigating risks associated with third-party vendors, including security assessments, audits, and compliance management.
Knowledge of industry frameworks such as SOC2, ISO 27001, and NIST.

Skills:

Strong understanding of information security principles and third-party risk management processes.
Experience with vendor management tools and security risk assessment platforms.
Strong communication skills to interact with technical and non-technical stakeholders.
Ability to evaluate, interpret, and communicate security and compliance risks.
Project management skills with the ability to prioritize tasks and meet deadlines.

Technical Proficiency:

Familiarity with security technologies, threat intelligence, and risk management tools.
Understanding of cloud security, data protection, and privacy laws.

Personal Attributes:

Strong analytical and problem-solving skills.
Detail-oriented with a focus on risk identification and mitigation.
Proactive and self-motivated, able to work independently and in teams.
Strong interpersonal skills, with the ability to build effective relationships across departments and external parties.