Third-Party Risk Analyst

Role: Third-Party Risk Analyst/ Vendor Risk Management

Experience: 6-12 Years
Location: Pune, Bangalore, Hyderabad, Bhubaneswar, Noida

Role Overview

We are looking for an experienced Third-Party Risk Management professional with 612 years of experience in cybersecurity, vendor risk, IT risk, supply chain security, or GRC. The candidate will be responsible for conducting vendor security assessments, identifying third-party cybersecurity risks, tracking remediation, and ensuring compliance with relevant security frameworks and organizational requirements.

Key Responsibilities

• Conduct third-party/vendor risk assessments across the complete vendor lifecycle, including onboarding, due diligence, periodic reviews, remediation, and offboarding.
• Assess cybersecurity risks associated with hardware suppliers, OEM/ODM partners, electronics manufacturers, and technology service providers.
• Review vendor security documentation including SOC 2 reports, ISO certificates, audit reports, penetration testing summaries, vulnerability reports, policies, risk registers, and remediation plans.
• Evaluate security controls covering IAM, network security, vulnerability management, SDLC, encryption, incident response, data protection, and business continuity.
• Identify control gaps, document findings, assign preliminary risk ratings, and recommend appropriate remediation actions.
• Track remediation activities and follow up with vendors and internal stakeholders until closure.
• Interpret and apply relevant third-party risk and supply-chain security practices.
• Maintain and manage vendor risk assessments using GRC/VRM platforms such as ServiceNow, Archer, OneTrust, or similar tools.
• Collaborate with Cybersecurity, IT, Procurement, Legal, Business teams, and external vendors to complete assessments within timelines.
• Manage multiple vendor assessments, follow-ups, findings, and remediation activities simultaneously.

Required Skills

• 6–12 years of experience in Third-Party Risk Management, Vendor Risk, Cybersecurity Risk, IT Risk, Supply Chain Security, or GRC.
• Hands-on experience in vendor security/risk assessments and due diligence.
• Strong understanding of third-party cybersecurity and supply-chain risks.
• Working knowledge of NIST SP 800-161, ISO/IEC 27001, ISO 28000, and SOC 2.
• Understanding of IAM, Network Security, Vulnerability Management, SDLC, Encryption, Incident Response, Data Protection, and Business Continuity.
• Experience identifying security control gaps, risk rating, documentation, and remediation tracking.
• Experience with ServiceNow, Archer, OneTrust, or similar GRC/VRM tools.
• Strong analytical, documentation, communication, and stakeholder management skills.