Technical Lead-Cybersecurity

Role Summary

We are seeking an experienced Third-Party Risk Management (TPRM) Specialist to manage and strengthen the organizations third-party cybersecurity risk program. The candidate will be responsible for conducting vendor risk assessments, evaluating security controls, monitoring third-party risks, ensuring regulatory compliance, and working closely with business, procurement, legal, privacy, and technology teams to mitigate risks associated with vendors, suppliers, and service providers.

Key Responsibilities

• Perform end-to-end Third-Party Risk Assessments for vendors, suppliers, partners, and service providers.
• Evaluate vendor security controls, policies, procedures, certifications, and compliance posture.
• Assess cybersecurity risks associated with new and existing third-party engagements.
• Review security questionnaires, SIG assessments, due diligence reports, SOC reports, ISO certifications, and other security documentation.
• Conduct inherent risk and residual risk assessments and provide risk ratings and recommendations.
• Monitor vendor risk posture and track remediation activities until closure.
• Collaborate with Procurement, Legal, Compliance, Privacy, Risk Management, and Security teams during vendor onboarding and periodic reviews.
• Review vendor compliance against security standards such as ISO 27001, NIST, SOC2, GDPR, PCI-DSS, and other applicable frameworks.
• Manage third-party risk registers, findings, exceptions, and remediation tracking.
• Analyze external attack surface, cyber ratings, and breach intelligence related to third parties.
• Support contract reviews, security requirements, and vendor security clauses.
• Prepare risk assessment reports, executive summaries, dashboards, and management presentations.
• Support internal and external audits related to third-party risk programs.
• Drive continuous improvement initiatives for vendor risk governance and assessment processes.
• Work with stakeholders to develop risk mitigation plans and monitor execution.

Required Skills

• Third-Party Risk Management (TPRM)
• Vendor Security Assessments
• Cyber Risk Management, Risk Remediation Tracking
• Security Due Diligence Reviews
• Risk Analysis Risk Rating Methodologies
• Vendor Onboarding Risk Governance
• Regulatory Compliance Audit Support
• Security Questionnaires SIG Reviews
• Security Policy Control Assessment
• Attack Surface External Risk Monitoring
• Security Reporting Dashboarding
• Understanding of Supply Chain Management