Third Party Risk Management expert

Job Description

We are looking for a Third-Party Cyber Risk Management Specialist to help implement and operate our internal TPRM framework.

Responsibilities:

• Support the implementation and continuous improvement of the TPRM operating model.

• Perform cybersecurity risk assessments of new and existing suppliers.

• Review security questionnaires and evidence, including ISO/IEC 27001 certificates, SOC 2 reports, penetration test summaries, and security policies.

• Identify control gaps and define remediation actions, compensating controls, and risk escalation requirements.

• Manage supplier assessments from onboarding and inherent risk screening through remediation, reassessment, and offboarding.

• Coordinate cybersecurity questionnaire responses for customers and partners.

• Maintain auditable records and support risk reporting through KPIs and KRIs.

• Work closely with GRC, Cybersecurity, Procurement, Legal, Business Owners, and suppliers.

• Identify opportunities to automate and streamline the TPRM lifecycle.

• Support knowledge transfer to the internal GRC team.

Profile:

• Experience in TPRM, cybersecurity risk, IT audit, security assurance, or GRC.

• Knowledge of supplier risk assessments, security controls, ISO/IEC 27001, and SOC 2.

• Strong analytical, communication, stakeholder management, and reporting skills.