Key Duties & Responsibilities: - Program Leadership & Governance
Design, implement, and mature the Third-Party Cyber Risk Management Program aligned with frameworks such as NIST CSF, ISO 27001, HIPAA, CIS Controls, and SOC2.
Develop and maintain policies, standards, and procedures governing vendor security due diligence, onboarding, monitoring, and offboarding.
Establish and iterate security exhibit for contracts, enforce compliance and iterate wherever needed.
Lead governance committees or working groups to discuss vendor risk posture, key issues, and remediation progress with business, procurement, and legal teams.
Define and track Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) for vendor risk and present them to leadership and risk committees.

Vendor Risk Assessment & Due Diligence
Oversee end-to-end third-party risk assessments including questionnaires, evidence review, and validation of security controls.
Evaluate vendors against recognized security frameworks (e.g., SOC 2, ISO 27001, PCI DSS, NIST CSF, HIPAA/HITRUST).




Manage inherent and residual risk scoring models to prioritize vendors based on business impact and data sensitivity.
Perform or oversee onsite or virtual vendor audits for high-risk vendors and ensure timely closure of identified gaps.
Work closely with Procurement and Legal to integrate cybersecurity clauses and right-to-audit provisions in vendor contracts.

Continuous monitoring and remediation:
Implement and manage continuous monitoring tools and processes (e.g., Security Scorecard, Recorded Future) to detect vendor security posture changes.
Ensure that remediation plans are documented, tracked, and closed within defined SLAs.
Coordinate periodic reassessments of critical and high-risk vendors to verify ongoing compliance.
Manage escalation processes for non-compliant or high-risk vendors, including executive reporting and remediation oversight.
Perform internal audits against client security

📌 Senior Program Manager Gurugram
🏢 R1 RCM Global Private
📍 Gurugram