Required Skills & Competencies – Must Have Third-Party Risk Management
• Solid expertise in Third-Party Risk Management (TPRM), Vendor Risk Management (VRM), Supplier Risk Management, Outsourcing Risk, ICT Risk, and Operational Resilience.
• Experience across the complete third-party lifecycle.
• Hands-on experience performing vendor due diligence reviews.
• Experience with security questionnaires and supplier assessments.
• Knowledge of control assessments and evidence validation.
• Experience supporting contract negotiations from a cybersecurity and risk perspective.
• Strong understanding of risk identification, risk analysis, risk rating, and remediation tracking.
• Experience reviewing ISO 27001 certifications and SOC 2 reports. Cybersecurity & Risk Assessment
• Strong cybersecurity and information risk management knowledge.
• Experience applying frameworks and standards such as: o ISO 27001 o NIST Cybersecurity Framework (CSF) o NIST 800 Series o SOC 2 o Vendor Security Control Frameworks
• Understanding of security governance, risk management, and compliance principles. Stakeholder Management
• Strong stakeholder engagement and relationship management skills.
• Ability to collaborate effectively with Procurement, Legal, Compliance, Security, Audit, and Business teams.
• Strong analytical, written, verbal, and presentation skills.
• Ability to review assessment quality and exercise sound risk judgement. ________________________________________ Required Skills & Competencies – Good to Have
• Knowledge of GRC and TPRM platforms such as: o ServiceNow GRC o OneTrust o SecurityScorecard o BitSight
• Knowledge of privacy and regulatory frameworks such as GDPR and NIS2.




• Procurement and vendor management experience.
• Executive presentation and reporting capabilities.
• Experience with continuous monitoring solutions and cyber risk intelligence platforms.
• Knowledge of cloud security and software supply chain risk management. ________________________________________ Experience & Qualifications Experience
• Total

Experience:
5-8 Years
• Relevant

Experience:
3-5 Years in: o Third-Party Risk Management (TPRM) o Vendor Risk Management (VRM) o Cyber Risk Management o Information Security Risk o Security Governance, Risk & Compliance (GRC) o Operational Risk Management

Key Responsibilities
Third-Party Risk Management
• Maintain and continuously improve the Third-Party Risk Management (TPRM) framework.
• Define, implement, and maintain vendor cyber risk assessment methodologies, processes, and standards.
• Perform supplier and vendor cybersecurity risk assessments.
• Conduct due diligence reviews for new and existing third parties.
• Execute vendor risk classification and tiering activities.
• Review and assess vendor security questionnaires and supporting evidence.
• Validate cybersecurity controls implemented by external vendors and service providers.
• Identify, document,



and evaluate cybersecurity risks associated with third-party relationships.
• Track remediation plans and monitor closure of identified risks and control gaps.
• Perform periodic vendor reassessments and ongoing risk reviews.
• Monitor third-party risks through continuous assessment and risk monitoring activities.
• Support vendor onboarding, ongoing governance, and offboarding processes.
• Partner with Procurement, Legal, Compliance, and Information Security teams throughout the vendor lifecycle.
• Support audits, compliance assessments, and regulatory reporting initiatives.
• Develop and maintain risk dashboards, KPIs, metrics, and executive reporting.
• Present risk findings and recommendations to senior stakeholders and governance committees. Governance, Risk & Compliance
• Maintain third-party risk inventories and risk registers.
• Support risk acceptance, exception management, and remediation governance processes.
• Contribute to cybersecurity governance and assurance activities.
• Support policy, standard, and procedure development related to third-party cybersecurity risk.
• Provide guidance to business teams on vendor security requirements and risk mitigation strategies. Assurance Reviews
• Review and assess: o ISO 27001 Certifications o SOC 1 Reports o SOC 2 Reports o PCI DSS Attestations o Penetration Test Reports o Internal Audit Reports o Security Policies and Procedures Emerging Risk Areas
• Artificial Intelligence (AI) Vendor Risk
• Software Supply Chain Risk
• Cloud Concentration Risk
• Fourth-Party Risk Management
• ICT and Critical Supplier Risk
• Operational Resilience and Outsourcing Risk

📌 IT&Data CS 3rd Party Risk Mgt (Hyderabad)
🏢 Infosys
📍 Hyderabad