TPRM Assessor

Role Overview

Relevant Experience for a Cyber Risk Assessor Role

Third-Party Cyber Risk Assessment

• Conducted end-to-end cyber risk assessments of third-party vendors, service providers, and technology suppliers.
• Evaluated security controls across domains including governance, identity and access management, vulnerability management, incident response, data protection, logging and monitoring, and cloud security.
• Reviewed evidence such as SOC reports, penetration tests, security policies, architecture diagrams, certifications, and independent assessments.
• Assessed inherent risk, control effectiveness, residual risk, and overall risk posture.
• Developed and documented assessment observations, risk statements, and remediation recommendations.
• Validated remediation evidence and supported closure of identified control gaps.
• Conducted assessment activities for critical and high-risk third parties.
• Maintained assessment documentation to support audit and regulatory review activities.
• Attention to detail and scope through assessments to ensure assessments were well documented.

Stakeholder Management

• Partnered with vendor managers, business, technology teams, procurement, legal, and risk stakeholders throughout the assessment lifecycle.
• Facilitated assessment planning, evidence collection, issue discussions, and risk treatment decisions.
• Communicated findings and residual risk ratings to senior stakeholders in clear business terms.
• Ability to evaluate mitigating controls based on scenario.
• Addressed and escalated supplier challenges related to evidence collection, control validation, and remediation planning.
• Built strong relationships with internal and external stakeholders to support timely assessment completion.

Risk and Control Expertise

• Performed assessments against industry frameworks and standards, including:
• NIST Cyber Security Framework (CSF)
• NIST SP 800-53
• ISO 27001
• PCI DSS
• SOC 2
• CSA
• Evaluated control design and operating effectiveness.
• Identified control deficiencies, compensating controls, and residual risks.
• Contributed to risk acceptance and risk treatment decisions using established governance processes.

Core Competencies

• Maintains ongoing Cyber certification (E.g., CISA, CISSP or other)
• Third-Party Cyber Risk Assessments
• Cyber Risk Analysis
• Control Validation
• Residual Risk Determination
• Vendor Security Reviews
• Risk Treatment & Remediation
• Assessment Documentation
• SOC Report Reviews
• Cloud Security Assessments (Hands on experience evaluating public cloud providers e.g., AWS, Azure, GCP)
• Security Questionnaire Reviews
• Evidence Analysis
• Regulatory Compliance
• Stakeholder Management
• Audit Support
• Risk Reporting
• Security Governance
• Information Security Controls

Assessment Lifecycle Management