Vendor Risk, GRC Analyst

This is a fully remote position, open to applicants in Bulgaria.

📋 Description

• Take charge of the vendor and third-party risk lifecycle within a rapidly growing technology company.

• Oversee the supplier register and manage the reassessment schedule based on the significance of suppliers.

• Monitor fourth-party dependencies and concentration risks among key suppliers, ensuring alignment with DORA ICT third-party standards and ISO 27001 supplier controls.

• Assist in maintaining policies, mapping controls, and collecting evidence to ensure the Statement of Applicability (SoA) is audit-ready.

• Perform risk assessments utilizing an ISO 31000-aligned approach and participate in Risk & Control Self-Assessment workshops and follow-up on remediation efforts.

• Aid in the upkeep of the RoPA, conduct DPIAs, and handle data subject requests.

⛳️ Requirements

• Strong foundation in GRC — Demonstrated experience in governance, risk management, compliance, IT audit, vendor risk, or information security, with direct responsibility for third-party/supplier risk.

• Expertise in third-party risk — Hands-on experience conducting vendor due diligence, security questionnaires (SIG, CAIQ, or similar), and reviewing contractual risks.

• Familiarity with frameworks — Knowledge of ISO/IEC 27001:2022 supplier controls, ISO 31000, and GDPR processor responsibilities; understanding of DORA third-party requirements is advantageous.

• Independent critical thinker — Comprehend the rationale behind controls, identify gaps, and suggest enhancements proactively.

• Practical compliance approach — Maintain a balance between thoroughness and efficiency.

• Effective communicator — Skillful in drafting questionnaires, risk memos, and responses directed at suppliers with clarity.

🏝️ Benefits

• Equal Opportunities Statement

• Diversity drives innovation and growth.

• Appreciates diverse perspectives and skill sets.