About this role
Area(s) of responsibility
Role Summary
We are seeking an experienced Third-Party Risk Management (TPRM) Specialist to manage and strengthen the organization's third-party cybersecurity risk program. The candidate will be responsible for conducting vendor risk assessments, evaluating security controls, monitoring third-party risks, ensuring regulatory compliance, and working closely with business, procurement, legal, privacy, and technology teams to mitigate risks associated with vendors, suppliers, and service providers.
Key Responsibilities
- Perform end-to-end Third-Party Risk Assessments for vendors, suppliers, partners, and service providers.
- Evaluate vendor security controls, policies, procedures, certifications, and compliance posture.
- Assess cybersecurity risks associated with new and existing third-party engagements.
- Review security questionnaires, SIG assessments, due diligence reports, SOC reports, ISO certifications, and other security documentation.
- Conduct inherent risk and residual risk assessments and provide risk ratings and recommendations.
- Monitor vendor risk posture and track remediation activities until closure.
- Collaborate with Procurement, Legal, Compliance, Privacy, Risk Management, and Security teams during vendor onboarding and periodic reviews.
- Review vendor compliance against security standards such as ISO 27001, NIST, SOC2, GDPR, PCI-DSS, and other applicable frameworks.
- Manage third-party risk registers, findings, exceptions, and remediation tracking.
- Analyze external attack surface, cyber ratings, and breach intelligence related to third parties.
- Support contract reviews, security requirements, and vendor security clauses.
- Prepare risk assessment reports, executive summaries, dashboards, and management presentations.
- Support internal and external audits related to third-party risk programs.
- Drive continuous improvement initiatives for vendor risk governance and assessment processes.
- Work with stakeholders to develop risk mitigation plans and monitor execution.
Required Skills
- Third-Party Risk Management (TPRM)
- Vendor Security Assessments
- Cyber Risk Management, Risk Remediation Tracking
- Security Due Diligence Reviews
- Risk Analysis & Risk Rating Methodologies
- Vendor Onboarding & Risk Governance
- Regulatory Compliance & Audit Support
- Security Questionnaires & SIG Reviews
- Security Policy & Control Assessment
- Attack Surface & External Risk Monitoring
- Security Reporting & Dashboarding
- Understanding of Supply Chain Management