Role:

We are seeking a detail-oriented Vendor Risk Management (VRM) Cybersecurity Specialist operating in 24x7 coverage to join our Cybersecurity team. In this role, you will own the end-to-end lifecycle of third-party security assessments from issuing security questionnaires to coordinating multi-disciplinary review panels across Security Assessment, Endpoint Security, Network Security, Identity & Access Management, Compliance, and Clinical Systems teams. You will play a critical frontline role in protecting patient data, ensuring HIPAA compliance, and reducing the organisation’s third-party attack surface.

Responsibilities:

- Questionnaire Management: Distribute, track, and manage vendor security questionnaires (SIG Lite, CAIQ, custom HIPAA-aligned forms) across the full vendor portfolio; chase outstanding responses and enforce SLA deadlines.
- Risk Tiering: Classify new and existing vendors into risk tiers (critical / high / medium / low) based on data sensitivity, system access, and clinical exposure, informing the depth of assessment required.
- Multi-Team Coordination: Serve as the primary liaison between vendors and internal sub-departments; schedule review sessions, distribute domain-specific questionnaire sections, and consolidate findings into unified risk reports.
- Gap Analysis & Findings: Identify control gaps in vendor responses against HIPAA Security Rule, NIST CSF, and organizational security standards; document findings clearly for both technical and non-technical stakeholders.
- Risk Scoring & Reporting: Produce risk scorecards with residual risk ratings; escalate high/critical findings to senior analysts and security leadership with recommended remediation paths or compensating controls.
- Remediation Tracking:



Issue and track Plan of Action & Milestones (POA&M;) to vendors; follow up on open items, verify evidence of remediation, and update risk register accordingly.
- BAA & Contract Support: Coordinate with Legal and Compliance on Business Associate Agreement (BAA) requirements; flag vendors that handle ePHI without adequate contractual safeguards.
- Vendor Register Maintenance: Maintain an accurate, up-to-date inventory of all third-party vendors, their risk profiles, assessment status, and re-assessment schedules in the GRC platform.
- Continuous Monitoring: Monitor vendors using threat intelligence feeds and security rating services (BitSight, Security Scorecard); alert relevant teams to newly identified risks between formal assessments.
- Policy & Process Improvement: Contribute to the evolution of VRM policies, questionnaire templates, and assessment procedures; support audit readiness activities for HIPAA, HITRUST, and SOC 2 reviews.

Experience:

6-9 years in cybersecurity, information security, IT risk, or vendor/third-party risk management.

Healthcare Context: Familiarity with HIPAA, ePHI handling, healthcare IT environments (EHR, medical devices)

Security Frameworks: Working knowledge of NIST CSF, ISO 27001, SOC 2 Type II, or HITRUST CSF

GRC Platforms: ServiceNow GRC, or similar vendor risk tooling

Security Domains: Baseline understanding of endpoint, network, IAM, and cloud security controls to triage vendor responses

Certifications: CompTIA Security+,

Communication: Robust written and verbal skills; able to convey technical risk clearly to non-technical stakeholders

Education:

Bachelor's in Cybersecurity, Information Systems, Computer Science, or related field — or equivalent experience

📌 Vendor Risk Management - Specialist / Sr Specialist (Hyderabad)
🏢 PrimEra Medical Technologies
📍 Hyderabad