Department - Risk Management- Third Party Risk Management (TPRM)

Location Mumbai- Head Office

JOB PURPOSE To lead the design, implementation, governance, and continuous enhancement of the organization's Third-Party Risk Management (TPRM) framework, ensuring effective identification, assessment, monitoring, and mitigation of risks arising from third-party relationships throughout the vendor lifecycle. The role is responsible for driving compliance with regulatory requirements, strengthening risk governance across Information Security, Data Protection, Business Continuity, Operational and Process Risk domains, enabling informed risk-based decision making by senior management, and fostering a resilient, technology-enabled, and scalable TPRM program aligned with the organization's risk appetite and strategic objectives.

KEY RESPONSIBILITIES

Functional Responsibility

- Own end-to-end design, implementation, and continuous enhancement of the Third-Party Risk Management (TPRM) framework, policy, and Standard Operating Procedures across the vendor lifecycle (onboarding, due diligence, contracting, ongoing monitoring, and exit).
- Provide strategic oversight and supervisory review of third-party risk assessments conducted by the TPRM team, ensuring consistency, quality, and depth across Information Security, Data Protection, Business Continuity, and Operational/Process risk domains.
- Define and maintain the vendor risk tiering methodology and volume/criticality-driven Turnaround Time (TAT) matrix for assessments across the third-party portfolio.
- Maintain TPRM Key Risk Indicators (KRIs); track, analyse, and report TPRM risk metrics and emerging vendor risk trends to senior management and the Risk Management Committee.




- Drive compliance with IRDAI ICS Guidelines 2026 and other applicable regulatory requirements pertaining to third party/outsourcing risk, including gap assessments, remediation tracking, and clause-level traceability for CRO and Board reporting.
- Lead, mentor, and build capability within the TPRM team; review their assessment reports, contractual reviews, and due diligence outputs prior to closure.
- Partner with Legal and Procurement to strengthen third-party contractual risk clauses and ensure alignment with organizational policy and regulatory standards.
- Prepare TPRM portfolio status, risk posture, and key observations.
- Drive process improvements, automation, and technology enablement to enhance efficiency and scalability of the TPRM lifecycle.
- Knowledge of ISO 27001, ISO 22301, ISO 31000, and data privacy regulations, and ensure framework alignment with these standards.
- Build and maintain strong working relationships with Departmental Risk Officers, Departmental Process Officers, and senior business stakeholders.

JOB REQUIREMENTS Qualification & Experience

- CISA, CRISC, and ISO 27001 / ISO 22301 Lead Auditor certifications strongly preferred.
- Robust working knowledge of IRDAI regulatory guidelines, ISO 27001, ISO 22301, ISO 31000, and data privacy frameworks.

Functional / Technical Skills

- Proven ability to lead and mentor a team while managing a high volume, multi-stakeholder assessment portfolio.
- Strong analytical, problem-solving, and decision-making skills with the ability to evaluate complex third-party risk scenarios.
- Excellent stakeholder management, negotiation, and executive communication skills.
- Ability to drive strategic initiatives and process improvements, not just oversee execution.
- High degree of ownership, attention to detail, and intellectual curiosity in identifying and addressing emerging vendor risks.

📌 Third Party Risk Management (TPRM) - Risk Management (Mumbai)
🏢 Sbi Life
📍 Mumbai