Relevant Experience for a Cyber Risk Assessor Role

Third-Party Cyber Risk Assessment

- Conducted end-to-end cyber risk assessments of third-party vendors, service providers, and technology suppliers.
- Evaluated security controls across domains including governance, identity and access management, vulnerability management, incident response, data protection, logging and monitoring, and cloud security.
- Reviewed evidence such as SOC reports, penetration tests, security policies, architecture diagrams, certifications, and independent assessments.
- Assessed inherent risk, control effectiveness, residual risk, and overall risk posture.
- Developed and documented assessment observations, risk statements, and remediation recommendations.
- Validated remediation evidence and supported closure of identified control gaps.
- Conducted assessment activities for critical and high-risk third parties.
- Maintained assessment documentation to support audit and regulatory review activities.
- Attention to detail and scope through assessments to ensure assessments were well documented.

Stakeholder Management
- Partnered with vendor managers, business, technology teams, procurement, legal, and risk stakeholders throughout the assessment lifecycle.
- Facilitated assessment planning, evidence collection, issue discussions, and risk treatment decisions.
- Communicated findings and residual risk ratings to senior stakeholders in clear business terms.




- Ability to evaluate mitigating controls based on scenario.
- Addressed and escalated supplier challenges related to evidence collection, control validation, and remediation planning.
- Built solid relationships with internal and external stakeholders to support timely assessment completion.

Risk and Control Expertise
- Performed assessments against industry frameworks and standards, including:

- NIST Cyber Security Framework (CSF)
- NIST SP 800-53
- ISO 27001
- PCI DSS
- SOC 2
- CSA
- Evaluated control design and operating effectiveness.
- Identified control deficiencies, compensating controls, and residual risks.
- Contributed to risk acceptance and risk treatment decisions using established governance processes.

Core Competencies

- Maintains ongoing Cyber certification (E.g., CISA, CISSP or other)
- Third-Party Cyber Risk Assessments
- Cyber Risk Analysis
- Control Validation
- Residual Risk Determination
- Vendor Security Reviews
- Risk Treatment & Remediation
- Assessment Documentation
- SOC Report Reviews
- Cloud Security Assessments (Hands on experience evaluating public cloud providers e.g., AWS, Azure, GCP)
- Security Questionnaire Reviews
- Evidence Analysis
- Regulatory Compliance
- Stakeholder Management
- Audit Support
- Risk Reporting
- Security Governance
- Information Security Controls
- Assessment Lifecycle Management

📌 TPRM Accessor (Kolkata)
🏢 Diverse Lynx
📍 Kolkata