Jr. GRC Engineer

Job Summary

We are seeking an experienced Third-Party Risk Management (TPRM) professional with 2 to 4 years of experience in managing vendor risk programs, conducting third-party due diligence, and driving risk governance across the vendor lifecycle. The ideal candidate will have strong expertise in assessing and managing third-party risks across cybersecurity, operational resilience, privacy, compliance, and business continuity domains.

The role requires close collaboration with Procurement, Legal, Information Security, Compliance, and Business teams to ensure effective risk management of vendors and external partners. Exposure to Governance, Risk & Compliance (GRC) frameworks and risk management practices is desirable.

Key Responsibilities

Third-Party Risk Management (Primary Focus)

Lead end-to-end Third-Party Risk Management activities across the vendor lifecycle.

Conduct inherent risk assessments and due diligence reviews for new and existing vendors.

Evaluate vendor controls related to Information Security, Cybersecurity, Data Privacy, Business Continuity, Regulatory Compliance, and Operational Risk.

Review and assess vendor security documentation, including SOC 1/SOC 2 reports, ISO 27001 certifications, penetration testing reports, and security questionnaires.

Identify, document, and communicate vendor risks and recommended mitigation strategies.

Track remediation plans and ensure timely closure of identified control gaps.

Drive periodic vendor reassessments and continuous monitoring activities.

Support contract reviews by identifying and recommending risk and compliance requirements.

Develop and maintain TPRM policies, standards, procedures, and risk assessment methodologies.

Produce risk reports, dashboards, and metrics for management and governance forums.

Partner with internal stakeholders to ensure risk-informed vendor onboarding and management decisions.

Governance & Risk Support (Secondary Focus)

Support broader GRC initiatives, including risk assessments, policy reviews, and compliance activities.

Maintain risk registers and support risk reporting processes.

Assist during internal and external audits related to third-party risk controls.

Contribute to the enhancement of risk governance frameworks and control environments.

Required Qualifications

2 - 4 years of overall experience in Third-Party Risk Management / Vendor Risk Management.

Strong experience conducting vendor due diligence and risk assessments.

Solid understanding of third-party risk domains including:

Cybersecurity Risk

Information Security

Data Privacy

Operational Risk

Regulatory & Compliance Risk

Experience reviewing SOC reports, ISO certifications, security questionnaires, and audit reports.

Experience interacting with senior stakeholders, vendors, and cross-functional teams.

Strong risk analysis, reporting, and communication skills.

Preferred Qualifications

Working knowledge of GRC frameworks and enterprise risk management practices.

Familiarity with ISO 27001, NIST, SOC 2, COBIT and related control frameworks.

Experience with TPRM/GRC platforms such as ServiceNow GRC, Archer, MetricStream, OneTrust, ProcessUnity or similar tools.

Good to have certifications such as CRISC, CISA, CISSP, CISM, or CTPRP

Ideal Candidate Profile

A seasoned TPRM professional who has led vendor risk assessments and third-party governance programs, can independently engage with senior stakeholders, and possesses sufficient GRC knowledge to align third-party risk activities with the organization's overall risk and compliance framework. This role should ideally be 7080% TPRM-focused and 2030% GRC-oriented.