IT&Data CS 3rd Party Risk Mgt

IT&Data CS 3rd Party Risk Mgt

Required Skills & Competencies – Must Have Third-Party Risk Management • Strong expertise in Third-Party Risk Management (TPRM), Vendor Risk Management (VRM), Supplier Risk Management, Outsourcing Risk, ICT Risk, and Operational Resilience. • Experience across the complete third-party lifecycle. • Hands-on experience performing vendor due diligence reviews. • Experience with security questionnaires and supplier assessments. • Knowledge of control assessments and evidence validation. • Experience supporting contract negotiations from a cybersecurity and risk perspective. • Strong understanding of risk identification, risk analysis, risk rating, and remediation tracking. • Experience reviewing ISO 27001 certifications and SOC 2 reports. Cybersecurity & Risk Assessment • Strong cybersecurity and information risk management knowledge. • Experience applying frameworks and standards such as: o ISO 27001 o NIST Cybersecurity Framework (CSF) o NIST 800 Series o SOC 2 o Vendor Security Control Frameworks • Understanding of security governance, risk management, and compliance principles. Stakeholder Management • Strong stakeholder engagement and relationship management skills. • Ability to collaborate effectively with Procurement, Legal, Compliance, Security, Audit, and Business teams. • Strong analytical, written, verbal, and presentation skills. • Ability to review assessment quality and exercise sound risk judgement. ________________________________________ Required Skills & Competencies – Good to Have • Knowledge of GRC and TPRM platforms such as: o ServiceNow GRC o OneTrust o SecurityScorecard o BitSight • Knowledge of privacy and regulatory frameworks such as GDPR and NIS2. • Procurement and vendor management experience. • Executive presentation and reporting capabilities. • Experience with continuous monitoring solutions and cyber risk intelligence platforms. • Knowledge of cloud security and software supply chain risk management. ________________________________________ Experience & Qualifications Experience • Total Experience: 5-8 Years • Relevant Experience: 3-5 Years in: o Third-Party Risk Management (TPRM) o Vendor Risk Management (VRM) o Cyber Risk Management o Information Security Risk o Security Governance, Risk & Compliance (GRC) o Operational Risk Management Key Responsibilities Third-Party Risk Management • Maintain and continuously improve the Third-Party Risk Management (TPRM) framework. • Define, implement, and maintain vendor cyber risk assessment methodologies, processes, and standards. • Perform supplier and vendor cybersecurity risk assessments. • Conduct due diligence reviews for new and existing third parties. • Execute vendor risk classification and tiering activities. • Review and assess vendor security questionnaires and supporting evidence. • Validate cybersecurity controls implemented by external vendors and service providers. • Identify, document, and evaluate cybersecurity risks associated with third-party relationships. • Track remediation plans and monitor closure of identified risks and control gaps. • Perform periodic vendor reassessments and ongoing risk reviews. • Monitor third-party risks through continuous assessment and risk monitoring activities. • Support vendor onboarding, ongoing governance, and offboarding processes. • Partner with Procurement, Legal, Compliance, and Information Security teams throughout the vendor lifecycle. • Support audits, compliance assessments, and regulatory reporting initiatives. • Develop and maintain risk dashboards, KPIs, metrics, and executive reporting. • Present risk findings and recommendations to senior stakeholders and governance committees. Governance, Risk & Compliance • Maintain third-party risk inventories and risk registers. • Support risk acceptance, exception management, and remediation governance processes. • Contribute to cybersecurity governance and assurance activities. • Support policy, standard, and procedure development related to third-party cybersecurity risk. • Provide guidance to business teams on vendor security requirements and risk mitigation strategies. Assurance Reviews • Review and assess: o ISO 27001 Certifications o SOC 1 Reports o SOC 2 Reports o PCI DSS Attestations o Penetration Test Reports o Internal Audit Reports o Security Policies and Procedures Emerging Risk Areas • Artificial Intelligence (AI) Vendor Risk • Software Supply Chain Risk • Cloud Concentration Risk • Fourth-Party Risk Management • ICT and Critical Supplier Risk • Operational Resilience and Outsourcing Risk