TPRM

Role & responsibilities

Run third-party risk assessments end-to-end from intake through approval and ongoing monitoring across client vendor portfolios.

Manage numerous engagements, primarily focused on helping organisations identify, assess, and mitigate risks associated with their third-party relationships.

Negotiate security requirements with vendors and track remediation deliverables to ensure timely closure of identified gaps.

Maintain third-party risk registers, contract renewals cadence, and produce executive reporting for leadership visibility.

Conduct TPRM programme maturity assessments against industry-leading frameworks (such as NIST CSF, ISO/IEC 27001, SIG, etc.) to identify gaps and recommend improvements.

Collaborate with clients to understand their vendor landscape and risk appetite, ensuring all engagements are delivered to the highest quality and professional standards.

Stay informed about emerging supply chain threats, regulatory expectations, and TPRM technologies, and incorporate this knowledge into client recommendations.

Provide Subject Matter Expertise on third-party risk management best practices and regulatory requirements to clients across various sectors.

Preferred candidate profile

Bachelor's degree in Information Security, Risk Management, Business Administration, or a related field; Master's degree preferred.

Minimum of 3 years of experience delivering third-party risk management projects, including vendor assessments, programme design, and risk reporting.

Proven track record of successfully executing complex projects within consulting or professional services environments.

In-depth understanding of TPRM principles and domains (such as vendor due diligence, contractual security requirements, ongoing monitoring, and fourth-party risk).

Strong knowledge of TPRM frameworks and standards (such as NIST CSF, ISO/IEC 27001, SIG, CAIQ) is advantageous.

Familiarity with TPRM platforms and tools (such as OneTrust, ServiceNow VRM, Archer, or BitSight) is beneficial.

Professional certifications such as CRISC, CTPRP, or CISA are a plus.

Excellent communication skills, both written and verbal, with the ability to explain complex technical concepts to non-technical stakeholders.

Strong analytical and problem-solving skills, with the ability to work collaboratively in a dynamic and diverse team environment.

Demonstrated capability to manage multiple projects concurrently and adhere to deadlines.