To support supplier security team and conduct supplier security assessments for cyber, data and AI risks

Mandatory SkillSet Required

ISO27001, NIST, IEC62443, Cybersecurity basics, TPRM

About the Role

We are looking for a driven and experienced Supplier Security & TPRM Qualified to join our Information Security team. In this role, you will be responsible for evaluating, monitoring, and mitigating security risks introduced by external vendors, software suppliers, and third-party partners. You will play a vital role in safeguarding our organization against cyber, data privacy, and emerging AI-related supply chain risks by conducting rigorous security assessments and enforcing industry compliance standards.

Key Responsibilities

- Execute Third-Party Security Assessments: Lead end-to-end vendor security reviews from onboarding to offboarding, including inherent risk classification, due diligence, and risk rating.
- Review Security Evidence & Questionnaires: Evaluate vendor security documentation, including SIG/CAIQ responses, SOC 1/SOC 2 reports, ISO 27001 certifications, VA/PT (Vulnerability Assessment & Penetration Testing) reports, and BCP/DR documentation.
- Assess Cyber, Data, and AI Risks: Evaluate suppliers for security vulnerabilities, data privacy compliance, and third-party AI/LLM integration risks (such as data handling, model security, and training data privacy).
- Identify Gaps & Track Remediation: Spot security control gaps during assessments, document risks, and work collaboratively with vendors and internal procurement/legal teams to track remediation plans through to closure.
- Framework Alignment:



Ensure vendor security practices align with leading frameworks and regulations, including ISO 27001, NIST CSF, IEC 62443 (for industrial/OT/IoT suppliers where applicable), and data privacy laws (such as GDPR and the DPDP Act 2023).
- Cross-Functional Collaboration: Act as a bridge between technical security teams, business stakeholders, legal, and external vendors to communicate security risk findings and ensure risk acceptance or mitigation.

Required Skills & Qualifications

- Experience: 3 years of professional experience in GRC, IT Audit, Information Security, or Third-Party Risk Management (TPRM).
- Framework Knowledge: Strong working knowledge and practical experience with ISO/IEC 27001 (ISMS), NIST CSF, and cybersecurity controls.
- Vendor Risk Expertise: Proven hands-on experience reviewing security questionnaires (SIG/CAIQ), SOC 2 Type II reports, and third-party risk assessments.
- Data & Emerging Risk Awareness: Familiarity with data privacy regulations (GDPR, DPDP Act 2023) and emerging AI risk governance concepts.
- Analytical & Assessment Skills: Strong capabilities in evidence validation, gap analysis, risk identification, and remediation tracking.
- Communication Skills: Excellent written and verbal communication skills with the ability to articulate technical security findings clearly to non-technical stakeholders and external vendors.
- Experience with ISO/IEC 42001 (AI Governance).
- Familiarity with IEC 62443 for industrial/operational technology (OT) security assessments.
- Relevant certifications (e.g., CISA, CRISC, ISO 27001 Lead Auditor, or similar security/audit credentials).

📌 Security Analyst (Bengaluru)
🏢 Quess Corp
📍 Bengaluru