IT&Data CS 3rd Party Risk Mgt

Responsibilities :

Key Responsibilities Third-Party Risk Management

Maintain and continuously improve the Third-Party Risk Management (TPRM) framework.

Define, implement, and maintain vendor cyber risk assessment methodologies, processes, and standards.

Perform supplier and vendor cybersecurity risk assessments.

Conduct due diligence reviews for new and existing third parties.

Execute vendor risk classification and tiering activities.

Review and assess vendor security questionnaires and supporting evidence.

Validate cybersecurity controls implemented by external vendors and service providers.

Identify, document, and evaluate cybersecurity risks associated with third-party relationships.

Track remediation plans and monitor closure of identified risks and control gaps.

Perform periodic vendor reassessments and ongoing risk reviews.

Monitor third-party risks through continuous assessment and risk monitoring activities.

Support vendor onboarding, ongoing governance, and offboarding processes.

Partner with Procurement, Legal, Compliance, and Information Security teams throughout the vendor lifecycle.

Support audits, compliance assessments, and regulatory reporting initiatives.

Develop and maintain risk dashboards, KPIs, metrics, and executive reporting.

Present risk findings and recommendations to senior stakeholders and governance committees. Governance, Risk & Compliance

Maintain third-party risk inventories and risk registers.

Support risk acceptance, exception management, and remediation governance processes.

Contribute to cybersecurity governance and assurance activities.

Support policy, standard, and procedure development related to third-party cybersecurity risk.

Provide guidance to business teams on vendor security requirements and risk mitigation strategies. Assurance Reviews

Review and assess: o ISO 27001 Certifications o SOC 1 Reports o SOC 2 Reports o PCI DSS Attestations o Penetration Test Reports o Internal Audit Reports o Security Policies and Procedures Emerging Risk Areas

Artificial Intelligence (AI) Vendor Risk

Software Supply Chain Risk

Cloud Concentration Risk

Fourth-Party Risk Management

ICT and Critical Supplier Risk

Operational Resilience and Outsourcing Risk

Technical and Professional Requirements:

Required Skills & Competencies - Must Have Third-Party Risk Management

Strong expertise in Third-Party Risk Management (TPRM), Vendor Risk Management (VRM), Supplier Risk Management, Outsourcing Risk, ICT Risk, and Operational Resilience.

Experience across the complete third-party lifecycle.

Hands-on experience performing vendor due diligence reviews.

Experience with security questionnaires and supplier assessments.

Knowledge of control assessments and evidence validation.

Experience supporting contract negotiations from a cybersecurity and risk perspective.

Strong understanding of risk identification, risk analysis, risk rating, and remediation tracking.

Experience reviewing ISO 27001 certifications and SOC 2 reports. Cybersecurity & Risk Assessment

Strong cybersecurity and information risk management knowledge.

Experience applying frameworks and standards such as: o ISO 27001 o NIST Cybersecurity Framework (CSF) o NIST 800 Series o SOC 2 o Vendor Security Control Frameworks

Understanding of security governance, risk management, and compliance principles. Stakeholder Management

Strong stakeholder engagement and relationship management skills.

Ability to collaborate effectively with Procurement, Legal, Compliance, Security, Audit, and Business teams.

Strong analytical, written, verbal, and presentation skills.

Ability to review assessment quality and exercise sound risk judgement. ________________________________________ Required Skills & Competencies - Good to Have

Knowledge of GRC and TPRM platforms such as: o ServiceNow GRC o OneTrust o SecurityScorecard o BitSight

Knowledge of privacy and regulatory frameworks such as GDPR and NIS2.

Procurement and vendor management experience.

Executive presentation and reporting capabilities.

Experience with continuous monitoring solutions and cyber risk intelligence platforms.

Knowledge of cloud security and software supply chain risk management. ________________________________________ Experience & Qualifications Experience

Total Experience: 5-8 Years

Relevant Experience: 3-5 Years in: o Third-Party Risk Management (TPRM) o Vendor Risk Management (VRM) o Cyber Risk Management o Information Security Risk o Security Governance, Risk & Compliance (GRC) o Operational Risk Management