Third Party Risk Management-Subcontractor

Area(s) of responsibility

Required Skills & Experience:

- 6+ years of experience in Third‑Party Risk Management, Vendor Risk, Cybersecurity Risk, IT Audit, or GRC roles.

- Strong understanding of the TPRM lifecycle and vendor risk frameworks.

- Hands‑on experience with security assessments and control testing.

- Knowledge of cybersecurity concepts, access controls, incident response, and data protection.

- Excellent analytical, documentation, and stakeholder communication skills.

- Experience working with global vendors and cross‑region stakeholders.

Key Responsibilities:

- Conduct inherent and residual risk assessments for vendors across cybersecurity, data privacy, operational, and compliance domains.

- Perform vendor due diligence during onboarding and periodic reviews.

- Review vendor‑provided evidence (SOC reports, ISO 27001, SIG, penetration test summaries, etc.).

- Assess vendor alignment with security frameworks such as ISO 27001, NIST, SOC 2, and HP internal security policies.

- Identify gaps, document findings, and recommend risk mitigation and remediation plans.

- Support compliance with global regulations (GDPR, data protection, internal audit requirements).

- Support the end‑to‑end third‑party lifecycle: onboarding, ongoing monitoring, issue management, and off‑boarding.

- Track vendor risks, remediation actions, and exceptions in GRC or risk management tools.

- Collaborate with Procurement, Legal, IT, Privacy, and Business stakeholders.

- Participate in internal audits, regulatory reviews, and risk governance forums.