IT&Data CS 3rd Party Risk Mgt

Job Description:

• Role Summary
• The Third Party Cyber Risk Manager is responsible for managing cybersecurity risks associated with suppliers vendors service providers outsourcing partners and strategic business partners
• The role ensures that cybersecurity risks are identified assessed monitored reported and mitigated throughout the third party lifecycle
• This position works closely with Procurement Legal Information Security Compliance Risk Management and Business stakeholders to establish and maintain an effective Third Party Risk Management TPRM program aligned with industry standards regulatory requirements and organizational security objectives

Key Responsibilities:

• Key Responsibilities
• Third Party Risk Management
• Maintain and continuously improve the Third Party Risk Management TPRM framework
• Define implement and maintain vendor cyber risk assessment methodologies processes and standards
• Perform supplier and vendor cybersecurity risk assessments
• Conduct due diligence reviews for new and existing third parties
• Execute vendor risk classification and tiering activities
• Review and assess vendor security questionnaires and supporting evidence
• Validate cybersecurity controls implemented by external vendors and service providers
• Identify document and evaluate cybersecurity risks associated with third party relationships
• Track remediation plans and monitor closure of identified risks and control gaps
• Perform periodic vendor reassessments and ongoing risk reviews
• Monitor third party risks through continuous assessment and risk monitoring activities
• Support vendor onboarding ongoing governance and offboarding processes
• Partner with Procurement Legal Compliance and Information Security teams throughout the vendor lifecycle
• Support audits compliance assessments and regulatory reporting initiatives
• Develop and maintain risk dashboards KPIs metrics and executive reporting
• Present risk findings and recommendations to senior stakeholders and governance committees
• Governance Risk Compliance
• Maintain third party risk inventories and risk registers
• Support risk acceptance exception management and remediation governance processes
• Contribute to cybersecurity governance and assurance activities
• Support policy standard and procedure development related to third party cybersecurity risk
• Provide guidance to business teams on vendor security requirements and risk mitigation strategies
• Assurance Reviews
• Review and assess
• o ISO 27001 Certifications
• o SOC 1 Reports
• o SOC 2 Reports
• o PCI DSS Attestations
• o Penetration Test Reports
• o Internal Audit Reports
• o Security Policies and Procedures
• Emerging Risk Areas
• Artificial Intelligence AI Vendor Risk
• Software Supply Chain Risk
• Cloud Concentration Risk
• Fourth Party Risk Management
• ICT and Critical Supplier Risk
• Operational Resilience and Outsourcing Risk

Technical Requirements:

• Required Skills Competencies Must Have
• Third Party Risk Management
• Strong expertise in Third Party Risk Management TPRM Vendor Risk Management VRM Supplier Risk Management Outsourcing Risk ICT Risk and Operational Resilience
• Experience across the complete third party lifecycle
• Hands on experience performing vendor due diligence reviews
• Experience with security questionnaires and supplier assessments
• Knowledge of control assessments and evidence validation
• Experience supporting contract negotiations from a cybersecurity and risk perspective
• Strong understanding of risk identification risk analysis risk rating and remediation tracking
• Experience reviewing ISO 27001 certifications and SOC 2 reports
• Cybersecurity Risk Assessment
• Strong cybersecurity and information risk management knowledge
• Experience applying frameworks and standards such as
• o ISO 27001
• o NIST Cybersecurity Framework CSF
• o NIST 800 Series
• o SOC 2
• o Vendor Security Control Frameworks
• Understanding of security governance risk management and compliance principles
• Stakeholder Management
• Strong stakeholder engagement and relationship management skills
• Ability to collaborate effectively with Procurement Legal Compliance Security Audit and Business teams
• Strong analytical written verbal and presentation skills
• Ability to review assessment quality and exercise sound risk judgement
• Required Skills Competencies Good to Have
• Knowledge of GRC and TPRM platforms such as
• o ServiceNow GRC
• o OneTrust
• o SecurityScorecard
• o BitSight
• Knowledge of privacy and regulatory frameworks such as GDPR and NIS2
• Procurement and vendor management experience
• Executive presentation and reporting capabilities
• Experience with continuous monitoring solutions and cyber risk intelligence platforms
• Knowledge of cloud security and software supply chain risk management
• Experience Qualifications
• Experience
• Total Experience 5 8 Years
• Relevant Experience 3 5 Years in
• o Third Party Risk Management TPRM
• o Vendor Risk Management VRM
• o Cyber Risk Management
• o Information Security Risk
• o Security Governance Risk Compliance GRC
• o Operational Risk Management

Preferred Skills:

Domain->Risk Services->Vendor Risk Management,Technology->Cloud Security->GCP - GRC,Technology->Cloud Security->AWS - GRC