For one of my customer we are looking for a Third Party Risk Cyber Management consultant.

Location: Europe(100% remote)

Duration: 6+ months

Description:

TPRM Process Implementation:

- Support the design and implementation of the new internal Third-Party Cyber Risk Management operating model.
- Translate the existing process and CyberVadis activities into a sustainable internal assessment methodology.
- Define the end-to-end workflow covering supplier onboarding, inherent risk screening, assessment, risk identification, remediation, acceptance, reassessment and offboarding.
- Develop and maintain TPRM procedures, assessment criteria, questionnaires, riskrating methodology, templates and supporting documentation.
- Define clear roles and responsibilities across Cybersecurity/GRC, Procurement, Legal, Business Owners and suppliers.
- Support definition of appropriate assessment tiers so that the depth of assessment is proportionate to supplier risk.
- Establish practical evidence requirements and criteria for determining when risks can be accepted, mitigated or escalated.
- Support transition of existing assessments, open risks and relevant historical information from the current model.
- Define operational KPIs/KRIs and reporting requirements to enable ongoing management oversight.
- Perform cybersecurity risk assessments of new and existing third parties.
- Review completed supplier security questionnaires and supporting evidence.
- Review evidence such as ISO/IEC 2701 certificates, SOC 2 reports, penetration test summaries, policies and other security assurance documentation.




- Identify control gaps and translate them into clear and actionable risk statements.
- Determine appropriate remediation actions and compensating controls.
- Follow up with suppliers and internal stakeholders to obtain missing information and close outstanding assessments.
- Escalate higher-risk suppliers and material residual risks through the defined risk governance process.
- Coordinate and prepare responses to cybersecurity questionnaires received from customers, partners and other external parties.
- Work with relevant internal subject-matter experts to validate responses and collect supporting evidence.
- Maintain a consistent and reusable repository of approved cybersecurity responses and evidence where appropriate.
- Identify questions that require escalation or specialist input rather than providing unsupported responses.
- Ensure responses accurately reflect implemented cybersecurity controls and approved company positions.

Governance & Continuous Improvement:

- Maintain appropriate records and evidence to provide an auditable trail of assessments, decisions, exceptions and risk acceptance.
- Support reporting on supplier risk exposure, outstanding assessments, remediation actions and overdue activities.
- Identify opportunities to automate or streamline the TPRM lifecycle.
- Ensure the process is scalable and risk-based rather than applying the same level of assessment to every supplier.
- Support knowledge transfer to the internal GRC team to ensure the process can be sustainably operated following the transition.

#J-18808-Ljbffr

📌 Third Party Risk Management consultant (España)
🏢 ASENIUM CONSULTING
📍 España