For one of my customer we are looking for a Third Party Risk Cyber Management consultant.

Obtenga más información sobre las tareas generales relacionadas con esta ocasión a continuación, así como sobre las habilidades requeridas.

Location: Europe(100% remote)

Duration: 6+ months

Description:
TPRM Process Implementation:

-

- Support the design and implementation of the new internal Third-Party Cyber Risk Management operating model.

- Translate the existing process and CyberVadis activities into a sustainable internal assessment methodology.

- Define the end-to-end workflow covering supplier onboarding, inherent risk screening, assessment, risk identification, remediation, acceptance, reassessment and offboarding.

- Develop and maintain TPRM procedures, assessment criteria, questionnaires, riskrating methodology, templates and supporting documentation.

- Define clear roles and responsibilities across Cybersecurity/GRC, Procurement, Legal, Business Owners and suppliers.

- Support definition of appropriate assessment tiers so that the depth of assessment is proportionate to supplier risk.

- Establish practical evidence requirements and criteria for determining when risks can be accepted, mitigated or escalated.

- Support transition of existing assessments, open risks and relevant historical information from the current model.

- Define operational KPIs/KRIs and reporting requirements to enable ongoing management oversight.

- Perform cybersecurity risk assessments of new and existing third parties.

- Review completed supplier security questionnaires and supporting evidence.

- Review evidence such as ISO/IEC 2701 certificates, SOC 2 reports, penetration test summaries,



policies and other security assurance documentation.

- Identify control gaps and translate them into clear and actionable risk statements.

- Determine appropriate remediation actions and compensating controls.

- Follow up with suppliers and internal stakeholders to obtain missing information and close outstanding assessments.

- Escalate higher-risk suppliers and material residual risks through the defined risk governance process.

- Coordinate and prepare responses to cybersecurity questionnaires received from customers, partners and other external parties.

- Work with relevant internal subject-matter experts to validate responses and collect supporting evidence.

- Maintain a consistent and reusable repository of approved cybersecurity responses and evidence where appropriate.

- Identify questions that require escalation or specialist input rather than providing unsupported responses.

- Ensure responses accurately reflect implemented cybersecurity controls and approved company positions.

Governance & Continuous Improvement:

-

- Maintain appropriate records and evidence to provide an auditable trail of assessments, decisions, exceptions and risk acceptance.

- Support reporting on supplier risk exposure, outstanding assessments, remediation actions and overdue activities.

- Identify opportunities to automate or streamline the TPRM lifecycle.

- Ensure the process is scalable and risk-based rather than applying the same level of assessment to every supplier. xghoner

- Support knowledge transfer to the internal GRC team to ensure the process can be sustainably operated following the transition.

#J-18808-Ljbffr

📌 Third party risk management consultant (España)
🏢 ASENIUM CONSULTING
📍 España