Remote TPRM Cyber Risk Lead

Asenium Consulting; España; Remote; EUR 60,000 - 90,000; Full time

Job summary

Asenium Consulting seeks a Third Party Risk Cyber Management consultant to help design and implement a scalable TPRM program across Europe, with 100% remote work. You will coordinate cybersecurity risk assessments of external providers and align processes with existing governance.

The role involves collaboration with Cybersecurity, Procurement, Legal, and business owners to define risk tiers, evidence requirements, and remediation actions, while ensuring documentation is auditable.

Qualifications

• Experience implementing Third-Party Risk Management (TPRM) in large organisations.
• Ability to translate frameworks and standards into internal processes.
• Strong reporting and KPI development for risk oversight.
• Familiarity with ISO/IEC 27001 and SOC 2 is a plus.

Responsibilities

• Support the design and implementation of the new internal Third-Party Cyber Risk Management operating model.
• Define end-to-end workflow for supplier lifecycle.
• Develop TPRM procedures, questionnaires, risk-rating methodology and templates.
• Review supplier security evidence and coordinate remediation actions.
• Coordinate responses to cybersecurity questionnaires from customers and partners.
• Maintain a reusable repository of approved responses and evidence.
• Escalate high-risk suppliers per governance process.
• Enable ongoing management oversight with KPIs/KRIs.
• Transition existing assessments from current model.
• Work with internal SMEs to validate responses.

Skills

TPRM

Cybersecurity

GRC

Stakeholder management

Risk analysis

Job description

Asenium Consulting seeks a Third Party Risk Cyber Management consultant to help design and implement a scalable TPRM program across Europe, with 100% remote work. You will coordinate cybersecurity risk assessments of external providers and align processes with existing governance.

The role involves collaboration with Cybersecurity, Procurement, Legal, and business owners to define risk tiers, evidence requirements, and remediation actions, while ensuring documentation is auditable.