Third Party Risk Management Expert

This is a fully remote position, open to applicants in Portugal.

📋 Description

• Assist in the execution and ongoing enhancement of the TPRM operating framework.

• Conduct cybersecurity risk evaluations for both new and existing suppliers.

• Analyze security questionnaires and documentation, such as ISO/IEC 27001 certificates, SOC 2 reports, penetration testing summaries, and security policies.

• Detect control deficiencies and establish remediation strategies, compensating controls, and risk escalation protocols.

• Oversee supplier evaluations from the onboarding process and inherent risk assessment to remediation, reassessment, and offboarding.

• Organize cybersecurity questionnaire replies for both customers and partners.

• Keep detailed auditable records and assist in risk reporting through Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs).

• Collaborate closely with Governance, Risk, and Compliance (GRC), Cybersecurity, Procurement, Legal, Business Owners, and suppliers.

• Spot chances to automate and enhance the TPRM lifecycle.

• Facilitate knowledge transfer to the internal GRC team.

⛳️ Requirements

• Proven experience in TPRM, cybersecurity risk management, IT auditing, security assurance, or GRC.

• Familiarity with supplier risk assessments.

• Understanding of security controls.

• Proficiency in ISO/IEC 27001 standards.

• Knowledge of SOC 2 requirements.

• Excellent analytical abilities.

• Strong verbal and written communication skills.

• Effective stakeholder management capabilities.

• Proficient reporting skills.

🏝️ Benefits

• Employees have the flexibility to work remotely.