Key Responsibilities
Third-Party Risk Management (TPRM)
- Conduct cybersecurity risk assessments for new and existing vendors
- Evaluate third-party security controls, processes, and compliance posture
- Review vendor security questionnaires and identify associated risks
- Support mitigation planning with stakeholders and business teams
Risk Assessment & Monitoring
- Monitor changes in business processes, systems, and operations impacting risk exposure
- Assess inherent and residual risks in vendor and IT environments
- Maintain updated risk assessments and control effectiveness documentation
Audit & Compliance Support
- Support internal and external audits related to cybersecurity and vendor risk
- Ensure audit evidence is accurate, complete, and properly documented
- Assist in regulatory compliance reviews and assessments
- Track and follow up on audit findings and remediation actions
Vendor Governance & Communication
- Collaborate with vendors, internal teams, and stakeholders for risk discussions
- Communicate security risks, findings, and recommendations clearly
- Ensure timely coordination of audit schedules and vendor reviews
Control Review & Policy Compliance
- Review cybersecurity controls against frameworks such as ISO 27001/27002, NIST, SOC1, SOC2, CIS
- Ensure alignment with internal policies, standards, and regulatory requirements
- Recommend improvements to control frameworks and governance processes
Incident & Investigation Support
- Assist in internal cybersecurity investigations when required
- Support analysis of security incidents involving third parties
- Contribute to root cause analysis and remediation efforts
Reporting & Documentation
- Document findings, risks, and control assessments with accuracy
- Provide reports on vendor risk posture and compliance status
- Maintain records of assessments, audits, and risk reviews
Continuous Improvement
- Identify gaps in third-party risk processes and suggest enhancements
- Contribute to strengthening TPRM frameworks and methodologies
- Stay updated on cybersecurity standards and regulatory changes
