For one of my customer we are looking for a Third Party Risk Cyber Management consultant.

Location:
Europe(100% remote) Duration: 6+ months Description: TPRM Process Implementation:
* Support the design and implementation of the new internal Third-Party Cyber Risk Management operating model.
* Translate the existing process and CyberVadis activities into a sustainable internal assessment methodology.
* Define the end-to-end workflow covering supplier onboarding, inherent risk screening, assessment, risk identification, remediation, acceptance, reassessment and offboarding.
* Develop and maintain TPRM procedures, assessment criteria, questionnaires, riskrating methodology, templates and supporting documentation.
* Define clear roles and responsibilities across Cybersecurity/GRC, Procurement, Legal, Business Owners and suppliers.
* Support definition of appropriate assessment tiers so that the depth of assessment is proportionate to supplier risk.
* Establish practical evidence requirements and criteria for determining when risks can be accepted, mitigated or escalated.
* Support transition of existing assessments, open risks and relevant historical information from the current model.
* Define operational KPIs/KRIs and reporting requirements to enable ongoing management oversight.
* Perform cybersecurity risk assessments of new and existing third parties.
* Review completed supplier security questionnaires and supporting evidence.
* Review evidence such as ISO/IEC 2701 certificates, SOC 2 reports, penetration test summaries, policies and other security assurance documentation.




* Identify control gaps and translate them into clear and actionable risk statements.
* Determine appropriate remediation actions and compensating controls.
* Follow up with suppliers and internal stakeholders to obtain missing information and close outstanding assessments.
* Escalate higher-risk suppliers and material residual risks through the defined risk governance process.
* Coordinate and prepare responses to cybersecurity questionnaires received from customers, partners and other external parties.
* Work with relevant internal subject-matter experts to validate responses and collect supporting evidence.
* Maintain a consistent and reusable repository of approved cybersecurity responses and evidence where appropriate.
* Identify questions that require escalation or specialist input rather than providing unsupported responses.
* Ensure responses accurately reflect implemented cybersecurity controls and approved company positions. Governance & Continuous Improvement:
* Maintain appropriate records and evidence to provide an auditable trail of assessments, decisions, exceptions and risk acceptance.
* Support reporting on supplier risk exposure, outstanding assessments, remediation actions and overdue activities.
* Identify opportunities to automate or streamline the TPRM lifecycle.
* Ensure the process is scalable and risk-based rather than applying the same level of assessment to every supplier.
* Support knowledge transfer to the internal GRC team to ensure the process can be sustainably operated following the transition. #J-18808-Ljbffr

📌 Third Party Risk Management consultant (Galicia)
🏢 ASENIUM CONSULTING
📍 Galicia