Third Party Risk Management - Subcontractor

Area(s) of responsibility
Required Skills & Experience
6+ years of experience in Third‑Party Risk Management, Vendor Risk, Cybersecurity Risk, IT Audit, or GRC roles.
Strong understanding of the TPRM lifecycle and vendor risk frameworks.
Hands‑on experience with security assessments and control testing.
Knowledge of cybersecurity concepts, access controls, incident response, and data protection.
Excellent analytical, documentation, and stakeholder communication skills.
Experience working with global vendors and cross‑region stakeholders.
Key Responsibilities
Conduct inherent and residual risk assessments for vendors across cybersecurity, data privacy, operational, and compliance domains.
Perform vendor due diligence during onboarding and periodic reviews.
Review vendor‑provided evidence (SOC reports, ISO 27001, SIG, penetration test summaries, etc.).
Assess vendor alignment with security frameworks such as ISO 27001, NIST, SOC 2, and HP internal security policies.
Identify gaps, document findings, and recommend risk mitigation and remediation plans.
Support compliance with global regulations (GDPR, data protection, internal audit requirements).
Support the end‑to‑end third‑party lifecycle: onboarding, ongoing monitoring, issue management, and off‑boarding.
Track vendor risks, remediation actions, and exceptions in GRC or risk management tools.
Collaborate with Procurement, Legal, IT, Privacy, and Business stakeholders.
Participate in internal audits, regulatory reviews, and risk governance forums.

Work arrangement
No