Key Responsibilities

Core TPRM Activities

- Support TPRM activities including vendor onboarding, annual vendor reviews, key vendor changes and vendor audits
- Align TPRM activities to current industry best practices
- Support management reporting
- Maintain an inventory of critical thirdparty vendors and systems
- Conduct thirdparty risk assessments covering operational, technology, resilience and other risks arising from third party relationships
- Identify key third-party risks
- Recommend and document risk mitigation action plans
- Work with internal and external stakeholders to track mitigation action plans to closure
- Assessing third-party Information Security controls and risks, including access management, data protection, vulnerability management, incident response, and security assurance.
- Review independent assurance reports received from vendors (e.g., SOC 1 / SOC 2, ISO certifications, BCP test summaries) to identify control gaps and mitigate key risks.
- Review of vendor BIAs, RTOs, RPOs, recovery strategies, DR architecture and exercise/test results.
- Assess vendor recovery capabilities, identify key business disruption risks from vendor outages and vendor control gaps,



and document key risk mitigation strategies.
- Follow-up on vendor action plans and track remediation plans to closure.

Required Handson TPRM Experience

- Conducting/managing TPRM activities
- Reviewing and assessing vendor SOC reports and thirdparty assurance reports
- Performing vendor risk assessments and documenting findings
- Strong written and verbal communication skills and stakeholder management with the ability to present risk in business terms.

Required Qualifications

- Graduate degree with 35 years of hands-on experience in ThirdParty / Vendor Risk Management.
- Demonstrated Information Security experience, including evaluating third-party security controls and technology risks.

Preferred Qualifications & Certifications

- CTPRA / CTPRP – Certified ThirdParty Risk Assessor / Skilled
- CRISC – Certified in Risk and Information Systems Control
- Experience evaluating vendor BCP/DR programs and operational resilience capabilities is preferred
- CBCP – Certified Business Continuity Professional
- Certifications in BCP/DR governance or Information Security are a plus

📌 Senior Analyst TPRM (India)
🏢 Altisource
📍 India