Overview

#Cyber Security Experts#

Responsibilities

• We are looking for an experienced 3PCRM Assessor to perform third-party cybersecurity risk assessments, evaluate vendor security controls, review evidence, conduct SME interviews and walkthroughs, and prepare assessment findings and final reports. The role requires strong knowledge of cybersecurity controls, risk frameworks, and third-party security assessment methodologies.
• Perform end-to-end third-party cybersecurity assessments in accordance with established assessment methodology and risk requirements.
• Conduct engagement and/or application-specific remote assessments based on defined scope.
• Review vendor security questionnaires, supporting documentation, policies, procedures, and evidence.
• Compare current Control Assessment (CA) vendor responses with previous assessments to identify and document changes in the vendor's control environment.
• Identify control gaps, risk observations, and changes in the vendor's security posture.
• Request and participate in assessment kickoff meetings and conduct follow-up discussions with vendors where required.
• Conduct SME interviews, control walkthroughs, demonstrations, and evidence validation sessions.
• Validate the effectiveness and implementation of applicable cybersecurity controls.
• Map vendor SOC 2 controls, SIG questionnaire responses, or equivalent third-party assurance artifacts to applicable company security questionnaires and control requirements.
• Evaluate whether existing third-party assurance reports and artifacts provide sufficient coverage of required controls.
• Identify control areas requiring additional clarification, evidence, or testing.
• Assess the applicability and effectiveness of controls based on the vendor's environment, services, data access, and risk profile.
• Identify and document initial assessment observations and potential control exceptions.
• Work with vendors and internal stakeholders to clarify assessment findings and obtain additional evidence where required.
• Determine and document final Control Exceptions based on assessment results.
• Prepare clear, concise, and evidence-based assessment findings and recommendations.
• Produce final assessment letters, results, and supporting documentation.
• Ensure assessment records are complete, accurate, and audit-ready.
• Collaborate with vendors, internal security teams, application owners, procurement, risk teams, and other stakeholders.
• Communicate assessment requirements, observations, evidence gaps, and control exceptions effectively.
• Conduct assessment follow-ups and manage outstanding actions through closure.
• Support consistent application of the organization's third-party cybersecurity assessment methodology.

Qualifications

• Location: Bangalore only {Re-location fine}
• Function: Cybersecurity / Third-Party Risk Management
• Role Type: Individual Contributor
• 5+ years of experience in Information Security, IT Audit, Cybersecurity Risk, GRC, or Third-Party Risk Management.
• Proven experience conducting Third-Party Cybersecurity / TPRM assessments.
• Strong experience in:
• Security control assessments
• Evidence review and validation
• SME interviews and walkthroughs
• Vendor risk assessments
• Control gap identification
• Assessment report writing
• Strong understanding of cybersecurity controls and risk management practices.
• Ability to independently assess vendor security environments and determine control effectiveness.
• Identity & Access Management (IAM)
• Privileged Access Management (PAM)
• Vulnerability Management
• Patch Management
• Cloud Security
• Incident Response & Management
• Security Operations
• Security Governance
• Data Protection & Sensitive Data Handling
• Production Support Controls
• Change Management
• Business Continuity / Disaster Recovery
• Physical Security
• Third-Party / Vendor Risk Management
• NIST CSF
• ISO/IEC 27001

Nice to have

• CISA, CISSP, CRISC, CISM, ISO 27001 Lead Auditor/Implementer, or equivalent certification.