About KPMG in India

KPMG entities in India are professional services firm(s). These Indian member firms are affiliated with KPMG International Limited. KPMG was established in India in August 1993. Our professionals leverage the global network of firms, and are conversant with local laws, regulations, markets and competition. KPMG has offices across India in Ahmedabad, Bengaluru, Chandigarh, Chennai, Gurugram, Hyderabad, Jaipur, Kochi, Kolkata, Mumbai, Noida, Pune, Vadodara and Vijayawada.

KPMG entities in India offer services to national and international clients in India across sectors. We strive to provide rapid, performance-based, industry-focussed and technology-enabled services, which reflect a shared knowledge of global and local industries and our experience of the Indian business environment.

Role Summary

We are seeking an experienced Third-Party Risk Management professional with a minimum of four years of relevant experience to support the design, implementation, execution, and continuous improvement of TPRM programmes.

The candidate will be responsible for conducting third-party risk assessments, managing vendor due diligence, monitoring remediation activities, and advising stakeholders on risks across cybersecurity, privacy, compliance, operational resilience, financial, and ESG domains.

Hands-on experience in configuring, operating, and enhancing the OneTrust Third-Party Risk Management module is mandatory. The ideal candidate will combine strong TPRM domain knowledge with practical OneTrust expertise to automate processes, improve risk visibility, and strengthen governance across the third-party lifecycle.

Key Responsibilities:

Third-Party Risk Management

- Execute end-to-end third-party risk assessments across onboarding, due diligence, periodic reviews, ongoing monitoring, and offboarding.
- Conduct inherent and residual risk assessments based on third-party criticality, services provided, data access, geographic exposure, and regulatory impact.
- Perform risk-based segmentation and tiering to determine appropriate assessment and due diligence requirements.
- Review third-party controls across cybersecurity, privacy, compliance, business continuity, operational resilience, financial, and ESG risk domains.
- Evaluate supporting evidence, including SOC reports, ISO certifications, security policies, audit reports, business continuity plans, and regulatory documentation.
- Identify control gaps, assess risk exposure, and recommend proportionate risk treatment and mitigation plans.
- Track findings, remediation actions, exceptions, compensating controls, and risk acceptance requests through closure.
- Monitor high-risk and critical third parties and escalate overdue assessments, remediation actions, and unresolved risks.

OneTrust Configuration and Administration

- Configure, operate, and maintain the OneTrust TPRM module to support end-to-end third-party risk management processes.
- Manage third-party inventories, engagement records, risk profiles, service classifications,



and vendor-tiering criteria.
- Configure assessment questionnaires, risk-scoring methodologies, conditional logic, thresholds, and inherent and residual risk-rating rules.
- Design and enhance workflows covering vendor onboarding, due diligence, assessments, approvals, remediation, reassessments, risk acceptance, and offboarding.
- Configure automated notifications, reminders, escalations, and approval processes.
- Manage findings, issues, action plans, exceptions, and risk acceptance processes within OneTrust.
- Develop dashboards, reports, assessment views, filters, and data extracts for business users and senior management.
- Support data imports, exports, mapping, migration, and quality validation activities.
- Perform user acceptance and regression testing for new configurations, enhancements, and platform releases.
- Prepare test scenarios, functional specifications, process flows, configuration workbooks, user guides, and operating procedures.
- Support production deployments, post-go-live stabilisation, troubleshooting, and continuous platform improvement.
- Identify opportunities to automate manual activities and improve assessment turnaround time, data quality, user experience, and reporting.

Stakeholder Engagement and Governance

- Collaborate with Procurement, Legal, Information Security, Privacy, Compliance, Enterprise Risk Management, Internal Audit, and business teams.
- Facilitate risk discussions with internal stakeholders and third-party representatives.
- Conduct workshops to gather and translate business requirements into functional and OneTrust configuration requirements.
- Communicate identified risks and control gaps and provide practical recommendations for vendor onboarding, continued engagement, and risk mitigation.
- Prepare risk summaries, assessment reports, governance packs, and executive-level dashboards.
- Monitor key risk indicators, performance metrics, SLAs, assessment status, open findings, and remediation ageing.
- Support regulatory reviews, internal and external audits, compliance activities, and TPRM maturity assessments.
- Provide OneTrust training, demonstrations, and ongoing support to business users, risk assessors, and platform administrators.

Required Skills and Experience:

TPRM Experience

- Minimum four years of experience in Third-Party Risk Management, Vendor Risk Management, Supplier Risk Management, IT Risk, Cyber Risk, or Operational Risk.
- Strong understanding of the third-party lifecycle, including onboarding, due diligence, contracting, monitoring, reassessment, remediation, and offboarding.




- Experience conducting inherent and residual risk assessments across multiple risk domains.
- Experience reviewing third-party controls, supporting evidence, and regulatory documentation.
- Strong understanding of third-party segmentation, service tiering, criticality assessments, and risk-based due diligence.
- Experience managing findings, remediation plans, exceptions, and risk acceptance processes.
- Ability to analyse and communicate complex risks and provide practical, business-focused recommendations.

OneTrust and Technology Experience

- Hands-on experience with the OneTrust Third-Party Risk Management module is mandatory.
- Experience configuring third-party inventories, engagements, assessments, questionnaires, workflows, notifications, and approval processes.
- Understanding of OneTrust objects, attributes, relationships, conditional logic, and risk-scoring methodologies.
- Experience managing findings, issues, remediation plans, exceptions, and risk acceptances in OneTrust.
- Experience developing operational reports, dashboards, filters, views, and data extracts.
- Experience supporting testing, production deployments, enhancements, troubleshooting, and post-go-live activities.
- Ability to translate TPRM business requirements into scalable OneTrust configurations and automation solutions.
- Exposure to OneTrust integrations, APIs, or data migration capabilities will be an advantage.
- Experience with other GRC or TPRM platforms, such as ServiceNow, Archer, or MetricStream, is desirable.

Preferred Qualifications

- Experience supporting large-scale or global TPRM programmes.
- Experience implementing, enhancing, or administering OneTrust TPRM solutions.
- Exposure to TPRM transformation, maturity assessments, operating model design, or process automation.
- Knowledge of frameworks and standards such as ISO 27001, SOC 1, SOC 2, NIST Cybersecurity Framework, CIS Controls, GDPR, and relevant industry regulations.
- Relevant certifications such as OneTrust certifications, CISA, CRISC, CISSP, or ISO 27001 Lead Auditor/Implementer.

What we are looking for A TPRM professional who can operate effectively at the intersection of risk, process, technology, and stakeholder management. The successful candidate will use strong TPRM knowledge and hands-on OneTrust expertise to streamline risk assessments, enhance risk visibility, improve governance, and support informed decision-making throughout the third-party lifecycle.

Equal Opportunity Employer KPMG India

KPMG India has a policy of providing equal chance for all applicants and employees regardless of their color, caste, religion, age, sex/gender, national origin, citizenship, sexual orientation, gender identity or expression, disability or other legally protected status. KPMG India values diversity and we request you to submit the details below to support us in our endeavor for diversity. Providing the below information is voluntary and refusal to submit such information will not be prejudicial to you.

📌 Third party risk management (Gurugram)
🏢 KPMG India
📍 Gurugram