Third-Party Risk Management Specialist (Tprm) (Hybrid Or Remote)

iTRTech Group; São Paulo; Hybrid; BRL 180,000 - 320,000; Full time

Job summary

EY BR in Brazil seeks a Senior Third-Party Risk Management Specialist to develop and improve risk frameworks. You will assess vendor risks across the lifecycle, perform due diligence, monitor critical suppliers, and present actionable risk recommendations to executives.

Ideal candidates bring extensive TPRM and vendor risk experience, with strong stakeholder management and advanced English for international environments. Hybrid or remote work options apply in Brazil.

Qualifications

• Extensive experience in Third-Party Risk Management across the vendor lifecycle.
• Proven ability to translate risk findings into business recommendations.
• Strong collaboration with multidisciplinary stakeholders and teams.
• Advanced or fluent English for international environments.

Responsibilities

• Support the development and continuous improvement of TPRM frameworks and processes.
• Conduct Third-Party Due Diligence and Risk Assessments throughout the vendor lifecycle.
• Evaluate Inherent Risk, Existing Controls, Residual Risk, and Third-Party Criticality.
• Support vendor segmentation and classification methodologies.
• Assess risks related to Cybersecurity, Technology, Privacy, Business Continuity, Compliance, and Operational Risk.
• Monitor critical third parties, Risk Indicators, and Remediation Plans.
• Evaluate Concentration Risk, Critical Dependencies, subcontractors, and Fourth-Party Risk.
• Conduct stakeholder interviews and workshops, preparing risk reports and executive presentations.

Skills

TPRM

Vendor Risk

Risk Assessments

Stakeholder Mgmt

English Proficiency

Tools

CRISC

CISA

ISO 27001

Job description

THIRD-PARTY RISK MANAGEMENT SPECIALIST (TPRM) (HYBRID OR REMOTE BRAZIL)

Company hires for hybrid or remote position

Location: Brazil — candidates from any region are welcome

Only candidates already based in Brazil will be considered

Work Model: Hybrid for candidates living in state capitals and Remote for candidates living in countryside/cities outside the state capitals

Language Requirements: Advanced or Fluent English

Seniority: Senior (6+ years)

Rate: Candidates should provide their salary expectations

About the Opportunity

We are looking for an experienced Third-Party Risk Management Specialist (TPRM) to support the development and improvement of third-party risk frameworks and processes.

The professional will assess vendor risks throughout the third-party lifecycle, conduct due diligence, monitor critical suppliers, and provide actionable risk recommendations to business stakeholders.

Responsibilities

• Support the development and continuous improvement of Third-Party Risk Management frameworks and processes.
• Conduct Third-Party Due Diligence and Risk Assessments throughout the vendor lifecycle.
• Evaluate Inherent Risk, Existing Controls, Residual Risk, and Third-Party Criticality.
• Support vendor segmentation and classification methodologies.
• Assess risks related to Cybersecurity, Technology, Privacy, Business Continuity, Compliance, and Operational Risk.
• Monitor critical third parties, Risk Indicators, and Remediation Plans.
• Evaluate Concentration Risk, Critical Dependencies, subcontractors, and Fourth-Party Risk.
• Conduct stakeholder interviews and workshops, preparing risk reports and executive presentations.

Requirements

• Strong professional experience in Third-Party Risk Management (TPRM), Vendor Risk, Supplier Risk, or Third-Party Cyber Risk.
• Experience managing risks throughout the third-party lifecycle.
• Proven experience conducting Third-Party Due Diligence and Risk Assessments.
• Solid understanding of Inherent Risk, Existing Controls, Residual Risk, and Third-Party Criticality.
• Knowledge of Risk and Control Management methodologies.
• Experience collaborating with multidisciplinary stakeholders and business teams.
• Ability to translate risk assessments into clear business recommendations.
• Advanced or fluent English for communication in international environments.

Nice to Have

• Experience with Cybersecurity, Technology Risk, Privacy, Business Continuity, Compliance, or Operational Risk.
• Knowledge of Vendor Segmentation and Classification.
• Experience with Critical Third-Party Monitoring and Remediation Plans.
• Understanding of Concentration Risk, Critical Dependencies, and Fourth-Party Risk.
• Certifications such as CRISC, CISA, CISM, CISSP, or ISO 27001-related certifications.

Ideal Candidate Profile

A Senior Third-Party Risk Management Specialist with strong experience in vendor risk assessments, third-party due diligence, and enterprise risk management. The ideal candidate demonstrates analytical thinking, stakeholder management capabilities, and the ability to assess complex third-party risks and communicate findings effectively to business and executive audiences.

5 Questions for Candidates

1. How many years of professional experience do you have in Third-Party Risk Management, Vendor Risk, or Supplier Risk?
2. What is your experience conducting Third-Party Due Diligence and assessing Inherent Risk, Residual Risk, and Third-Party Criticality?
3. Have you worked with Vendor Segmentation, Critical Third-Party Monitoring, or Remediation Plans?
4. What is your experience assessing Cybersecurity, Privacy, Business Continuity, Concentration Risk, or Fourth-Party Risk?
5. What are your current salary, salary expectations, and availability to work in a hybrid or remote model in Brazil?

Keywords

Third-Party Risk Management, TPRM, Vendor Risk Management, Supplier Risk, Third-Party Cyber Risk, Third-Party Due Diligence, Risk Assessment, Inherent Risk, Residual Risk, Risk and Control Management, Vendor Segmentation, Vendor Classification, Third-Party Criticality, Critical Third-Party Monitoring, Remediation Plans, Concentration Risk, Fourth-Party Risk, Cybersecurity, Technology Risk, Privacy Risk, Business Continuity, Compliance, Operational Risk, CRISC, CISA, CISM, CISSP, ISO 27001

#EY BR