Cyber Security- TPRM Analyst

#Cyber Security Experts#

TPRM Analyst

• Job Title: Third-Party Cybersecurity & Risk Management (3PCRM) Analyst / SME
• Experience: 5 to 12 years
  
  Location: Bangalore only {Re-location fine}
• Function: Cybersecurity Risk / Third-Party Risk Management
• Role Type: Individual Contributor
• Role Overview
• We are looking for an experienced Third-Party Cybersecurity & Risk Management (3PCRM) professional to support third-party cybersecurity assessments, intake and triage activities, quality assurance, workflow management, and stakeholder coordination. The role will be responsible for ensuring assessments are appropriately scoped, executed, documented, and completed in accordance with internal processes and audit requirements.
• Key Responsibilities
• 1. Third-Party Risk Intake & Assessment Triage
• Review and triage completed intake forms, IRA, TPSD, assessment history, and related documentation to determine whether a third-party cybersecurity assessment is required.
• Validate assessment scope, applicability, and required assessment type based on third-party risk and organizational requirements.
• Ensure completion of assessment planning and information-gathering artifacts.
• Identify missing or incomplete information and coordinate with stakeholders/vendors for resolution.
• 2. Cybersecurity Control Assessment Management
• Initiate and action Control Assessments (CAs) based on defined processes.
• Delegate assessments to assigned assessors and advance assessment workflows within the designated platform.
• Review questionnaire responses for completeness, accuracy, and alignment with applicable controls.
• Push assessments to the next workflow stage or return/reject them to vendors when responses or evidence are insufficient.
• Evaluate whether previous assessments can be leveraged and support appropriate scoring or determination of assessment applicability/out-of-scope status.
• Track assessment progress and ensure activities are completed within defined SLAs.
• 3. Quality Assurance & Assessment Review
• Perform QA reviews of assessor workpapers, control responses, evidence, assessment notes, and final reports.
• Review assessor commentary to ensure it is:
• Relevant to the applicable control
• Clear and understandable
• Complete and adequately supported by evidence
• Consistent with assessment requirements
• Identify documentation, evidence, control, and quality gaps and drive appropriate remediation.
• Review final assessment artifacts and tracking records for completeness and audit readiness.
• Ensure assessments comply with internal policies, procedures, methodology, and audit requirements.
• 4. Stakeholder & Workflow Management
• Triage, action, and route engagement and process-related inquiries received through the 3PCRM mailbox.
• Coordinate with internal stakeholders, assessors, vendors, application owners, procurement teams, and risk teams as required.
• Communicate assessment assignments, status, workflow requirements, and outstanding actions.
• Follow up with stakeholders to resolve assessment blockers and maintain SLA adherence.
• Maintain accurate assessment status and reporting information.
• 5. Third-Party Cyber Risk & Compliance
• Support identification and evaluation of cybersecurity risks associated with third parties.
• Ensure appropriate cybersecurity controls are assessed based on vendor risk, service scope, data access, and business criticality.
• Support audit and compliance requirements related to third-party risk management.
• Maintain accurate assessment documentation and evidence to support internal and external audits.
• Contribute to continuous improvement of the 3PCRM assessment and QA process.
• Required Skills & Experience
• 5+ years of experience in Third-Party Risk Management, Cyber Risk, IT Audit, Information Security, GRC, Cybersecurity Assurance, or Quality Assurance.
• Strong experience in reviewing third-party cybersecurity assessments, control assessments, workpapers, and assessment reports.
• Experience identifying gaps in evidence, documentation, control responses, and assessor commentary.
• Strong understanding of IT controls, cybersecurity controls, risk assessment, and control testing concepts.
• Experience with assessment intake, triage, workflow management, SLA tracking, and quality assurance.
• Strong analytical and attention-to-detail skills.
• Excellent written and verbal communication skills.
• Ability to work with multiple stakeholders and manage assessments through completion.
• Experience supporting internal/external audits and maintaining audit-ready documentation.
• Tools & Platforms
• Experience with one or more of the following is preferred:
• Jira – workflow and issue tracking
• Coupa – third-party/vendor management
• SharePoint – document and evidence management
• GRC / Third-Party Risk Management platforms
• Microsoft Excel and reporting tools
• Preferred Qualifications
• Experience with Third-Party Risk Management (TPRM/3PCRM) processes.
• Knowledge of cybersecurity frameworks such as NIST CSF, ISO 27001, SOC 2, CIS Controls, or similar.
• Experience in vendor security assessments and cybersecurity questionnaires.
• CISA, CRISC, CISSP, ISO 27001, or relevant cybersecurity/risk certification is an advantage.
• Experience working in a regulated or enterprise environment is preferred.
• Key Competencies
• Third-Party Cyber Risk Management
• Assessment Intake & Triage
• Cybersecurity Control Assessment
• Quality Assurance / Assessment QA
• Control & Evidence Review
• Risk-Based Decision Making
• Workflow & SLA Management
• Audit Readiness
• Stakeholder Management
• Documentation & Reporting
• Attention to Detail
• Process Improvement