Overview

#Cyber Security Experts#

Responsibilities

• We are looking for an experienced Third-Party Cybersecurity & Risk Management (3PCRM) professional to support third-party cybersecurity assessments, intake and triage activities, quality assurance, workflow management, and stakeholder coordination. The role will be responsible for ensuring assessments are appropriately scoped, executed, documented, and completed in accordance with internal processes and audit requirements.
• Third-Party Risk Intake & Assessment Triage
• Review and triage completed intake forms, IRA, TPSD, assessment history, and related documentation to determine whether a third-party cybersecurity assessment is required.
• Validate assessment scope, applicability, and required assessment type based on third-party risk and organizational requirements.
• Ensure completion of assessment planning and information-gathering artifacts.
• Identify missing or incomplete information and coordinate with stakeholders/vendors for resolution.
• Cybersecurity Control Assessment Management
• Initiate and action Control Assessments (CAs) based on defined processes.
• Delegate assessments to assigned assessors and advance assessment workflows within the designated platform.
• Review questionnaire responses for completeness, accuracy, and alignment with applicable controls.
• Push assessments to the next workflow stage or return/reject them to vendors when responses or evidence are insufficient.
• Evaluate whether previous assessments can be leveraged and support appropriate scoring or determination of assessment applicability/out-of-scope status.
• Track assessment progress and ensure activities are completed within defined SLAs.
• Quality Assurance & Assessment Review
• Perform QA reviews of assessor workpapers, control responses, evidence, assessment notes, and final reports.
• Review assessor commentary to ensure it is:
• Relevant to the applicable control
• Clear and understandable
• Complete and adequately supported by evidence
• Consistent with assessment requirements
• Identify documentation, evidence, control, and quality gaps and drive appropriate remediation.
• Review final assessment artifacts and tracking records for completeness and audit readiness.
• Ensure assessments comply with internal policies, procedures, methodology, and audit requirements.
• Stakeholder & Workflow Management
• Triage, action, and route engagement and process-related inquiries received through the 3PCRM mailbox.
• Coordinate with internal stakeholders, assessors, vendors, application owners, procurement teams, and risk teams as required.
• Communicate assessment assignments, status, workflow requirements, and outstanding actions.
• Follow up with stakeholders to resolve assessment blockers and maintain SLA adherence.
• Maintain accurate assessment status and reporting information.
• Third-Party Cyber Risk & Compliance

Qualifications

• Function: Cybersecurity Risk / Third-Party Risk Management
• Role Type: Individual Contributor
• 5+ years of experience in Third-Party Risk Management, Cyber Risk, IT Audit, Information Security, GRC, Cybersecurity Assurance, or Quality Assurance.
• Strong experience in reviewing third-party cybersecurity assessments, control assessments, workpapers, and assessment reports.
• Strong understanding of IT controls, cybersecurity controls, risk assessment, and control testing concepts.
• Strong analytical and attention-to-detail skills.
• Excellent written and verbal communication skills.
• Ability to work with multiple stakeholders and manage assessments through completion.
• Tools & Platforms
• Jira – workflow and issue tracking
• Coupa – third-party/vendor management
• SharePoint – document and evidence management
• GRC / Third-Party Risk Management platforms
• Microsoft Excel and reporting tools
• Knowledge of cybersecurity frameworks such as NIST CSF, ISO 27001, SOC 2, CIS Controls, or similar.
• CISA, CRISC, CISSP, ISO 27001, or relevant cybersecurity/risk certification is an advantage.
• Key Competencies
• Third-Party Cyber Risk Management
• Assessment Intake & Triage
• Cybersecurity Control Assessment
• Quality Assurance / Assessment QA
• Control & Evidence Review
• Risk-Based Decision Making
• Workflow & SLA Management
• Audit Readiness
• Stakeholder Management
• Documentation & Reporting
• Attention to Detail
• Process Improvement