For one of my customer we are looking for a Third Party Risk Cyber Management consultant.

Location: Europe(100% remote)

Duration: 6+ months

Description: TPRM Process Implementation:

Support the design and implementation of the new internal Third-Party Cyber Risk Management operating model.

Translate the existing process and CyberVadis activities into a sustainable internal assessment methodology.

Define the end-to-end workflow covering supplier onboarding, inherent risk screening, assessment, risk identification, remediation, acceptance, reassessment and offboarding.

Develop and maintain TPRM procedures, assessment criteria, questionnaires, riskrating methodology, templates and supporting documentation.

Define clear roles and responsibilities across Cybersecurity/GRC, Procurement, Legal, Business Owners and suppliers.

Support definition of appropriate assessment tiers so that the depth of assessment is proportionate to supplier risk.

Establish practical evidence requirements and criteria for determining when risks can be accepted, mitigated or escalated.

Support transition of existing assessments, open risks and relevant historical information from the current model.

Define operational KPIs/KRIs and reporting requirements to enable ongoing management oversight.

Perform cybersecurity risk assessments of new and existing third parties.

Review completed supplier security questionnaires and supporting evidence.

Review evidence such as ISO/IEC 2701 certificates, SOC 2 reports, penetration test summaries, policies and other security assurance documentation.





Identify control gaps and translate them into clear and actionable risk statements.

Determine appropriate remediation actions and compensating controls.

Follow up with suppliers and internal stakeholders to obtain missing information and close outstanding assessments.

Escalate higher-risk suppliers and material residual risks through the defined risk governance process.

Coordinate and prepare responses to cybersecurity questionnaires received from customers, partners and other external parties.

Work with relevant internal subject-matter experts to validate responses and collect supporting evidence.

Maintain a consistent and reusable repository of approved cybersecurity responses and evidence where appropriate.

Identify questions that require escalation or specialist input rather than providing unsupported responses.

Ensure responses accurately reflect implemented cybersecurity controls and approved company positions.

Governance & Continuous Improvement:

Maintain appropriate records and evidence to provide an auditable trail of assessments, decisions, exceptions and risk acceptance.

Support reporting on supplier risk exposure, outstanding assessments, remediation actions and overdue activities.

Identify opportunities to automate or streamline the TPRM lifecycle.

Ensure the process is scalable and risk-based rather than applying the same level of assessment to every supplier.

Support knowledge transfer to the internal GRC team to ensure the process can be sustainably operated following the transition.

#J-18808-Ljbffr

📌 Third Party Risk Management consultant (Mogán)
🏢 ASENIUM CONSULTING
📍 Mogán