Required Skills &

Competencies –

- Must Have Third-Party Risk Management

- Strong expertise in Third-Party Risk Management (TPRM), Vendor Risk Management (VRM), Supplier Risk Management, Outsourcing Risk, ICT Risk, and Operational Resilience.
- Experience across the complete third-party lifecycle.
- Hands-on experience performing vendor due diligence reviews.
- Experience with security questionnaires and supplier assessments.
- Knowledge of control assessments and evidence validation.
- Experience supporting contract negotiations from a cybersecurity and risk perspective.
- Strong understanding of risk identification, risk analysis, risk rating, and remediation tracking.
- Experience reviewing ISO 27001 certifications and SOC 2 reports. Cybersecurity &
- Risk Assessment
- Strong cybersecurity and information risk management knowledge.
- Experience applying frameworks and standards such as: o ISO 27001 o NIST Cybersecurity Framework (CSF) o NIST 800 Series o SOC 2 o Vendor Security Control Frameworks
- Understanding of security governance, risk management, and compliance principles.

Stakeholder

Management

- Strong stakeholder engagement and relationship management skills.
- Ability to collaborate effectively with Procurement, Legal, Compliance, Security, Audit, and Business teams.
- Strong analytical, written, verbal, and presentation skills.
- Ability to review assessment quality and exercise sound risk judgement. ________________________________________ Required Skills & Competencies –

- Good to Have
- Knowledge of GRC and TPRM platforms such as: o ServiceNow GRC o OneTrust o SecurityScorecard o BitSight




- Knowledge of privacy and regulatory frameworks such as GDPR and NIS2.
- Procurement and vendor management experience.
- Executive presentation and reporting capabilities.
- Experience with continuous monitoring solutions and cyber risk intelligence platforms.
- Knowledge of cloud security and software supply chain risk management. ________________________________________ Experience &

Qualifications Experience

- Total Experience: 5-8 Years
- Relevant Experience: 3-5 Years in: o Third-Party Risk Management (TPRM) o Vendor Risk Management (VRM) o Cyber Risk Management o Information Security Risk o Security Governance, Risk &

- Compliance (GRC) o Operational Risk Management Key Responsibilities Third-Party Risk Management
- Maintain and continuously improve the Third-Party Risk Management (TPRM) framework.
- Define, implement, and maintain vendor cyber risk assessment methodologies, processes, and standards.
- Perform supplier and vendor cybersecurity risk assessments.
- Conduct due diligence reviews for current and existing third parties.
- Execute vendor risk classification and tiering activities.
- Review and assess vendor security questionnaires and supporting evidence.
- Validate cybersecurity controls implemented by external vendors and service providers.
- Identify, document,



and evaluate cybersecurity risks associated with third-party relationships.
- Track remediation plans and monitor closure of identified risks and control gaps.
- Perform periodic vendor reassessments and ongoing risk reviews.
- Monitor third-party risks through continuous assessment and risk monitoring activities.
- Support vendor onboarding, ongoing governance, and offboarding processes.
- Partner with Procurement, Legal, Compliance, and Information Security teams throughout the vendor lifecycle.
- Support audits, compliance assessments, and regulatory reporting initiatives.
- Develop and maintain risk dashboards, KPIs, metrics, and executive reporting.
- Present risk findings and recommendations to senior stakeholders and governance committees. Governance, Risk &
- Compliance
- Maintain third-party risk inventories and risk registers.
- Support risk acceptance, exception management, and remediation governance processes.
- Contribute to cybersecurity governance and assurance activities.
- Support policy, standard, and procedure development related to third-party cybersecurity risk.
- Provide guidance to business teams on vendor security requirements and risk mitigation strategies.

Assurance

Reviews

- Review and assess: o ISO 27001 Certifications o SOC 1 Reports o SOC 2 Reports o PCI DSS Attestations o Penetration Test Reports o Internal Audit Reports o Security Policies and Procedures Emerging Risk Areas
- Artificial Intelligence (AI) Vendor Risk
- Software Supply Chain Risk
- Cloud Concentration Risk
- Fourth-Party Risk Management
- ICT and Critical Supplier Risk
- Operational Resilience and Outsourcing Risk

📌 IT&Data CS 3rd Party Risk Mgt (Hyderabad)
🏢 Infosys
📍 Hyderabad