Role Overview :

As a Third Party Security Review lead, you will serve as the primary guardian of the organization's digital ecosystem by evaluating the security posture of our external partners and vendors. You will navigate complex risk landscapes, collaborating closely with procurement, legal, and business stakeholders to ensure that every third-party integration aligns with our stringent information security standards.

Key Responsibilities :

- Execute comprehensive security assessments for third-party vendors to identify potential risks and ensure alignment with global information security policies.

- Manage the end-to-end Vendor Risk Management lifecycle, from initial due diligence and questionnaire evaluation to remediation tracking and final risk acceptance.

- Collaborate with cross-functional teams, including Legal and Procurement, to integrate security requirements into vendor contracts and service level agreements.

- Conduct deep-dive technical reviews of vendor security controls, including cloud architecture, data protection measures, and incident response capabilities.

- Drive the continuous improvement of the TPISR framework by automating assessment workflows and refining risk scoring methodologies.

- Communicate complex technical risks to non-technical stakeholders, providing actionable insights that facilitate informed business decision-making.

Required Skillset :

- Demonstrated expertise in managing Information Security Risk Management programs with 7 - 10 years of professional experience in large-scale enterprise environments.

- Proven ability to evaluate complex security frameworks such as ISO 27001, SOC2, NIST, and GDPR.

- Strong interpersonal skills with the ability to influence senior stakeholders and negotiate security requirements.

- Exceptional analytical capabilities to synthesize technical audit findings into clear, concise reports.

- A proactive mindset with the ability to operate effectively in a hybrid work environment across Bangalore, Pune, or Hyderabad.

- A Bachelor's or Master's degree in Computer Science, Information Security, or a related field, complemented by relevant industry certifications such as CISA, CRISC, or CISSP.