Third Party Risk Management consultant

Asenium Consulting; España; Remote; EUR 60,000 - 90,000; Full time

Job summary

Asenium Consulting seeks a Third Party Risk Cyber Management consultant to help design and implement a scalable TPRM program across Europe, with 100% remote work. You will coordinate cybersecurity risk assessments of external providers and align processes with existing governance.

The role involves collaboration with Cybersecurity, Procurement, Legal, and business owners to define risk tiers, evidence requirements, and remediation actions, while ensuring documentation is auditable.

Qualifications

• Experience implementing Third-Party Risk Management (TPRM) in large organisations.
• Ability to translate frameworks and standards into internal processes.
• Strong reporting and KPI development for risk oversight.
• Familiarity with ISO/IEC 27001 and SOC 2 is a plus.

Responsibilities

• Support the design and implementation of the new internal Third-Party Cyber Risk Management operating model.
• Define end-to-end workflow for supplier lifecycle.
• Develop TPRM procedures, questionnaires, risk-rating methodology and templates.
• Review supplier security evidence and coordinate remediation actions.
• Coordinate responses to cybersecurity questionnaires from customers and partners.
• Maintain a reusable repository of approved responses and evidence.
• Escalate high-risk suppliers per governance process.
• Enable ongoing management oversight with KPIs/KRIs.
• Transition existing assessments from current model.
• Work with internal SMEs to validate responses.

Skills

TPRM

Cybersecurity

GRC

Stakeholder management

Risk analysis

Job description

For one of my customer we are looking for a Third Party Risk Cyber Management consultant.

Location: Europe(100% remote)

Duration: 6+ months

Description:

TPRM Process Implementation:

• Support the design and implementation of the new internal Third-Party Cyber Risk Management operating model.
• Translate the existing process and CyberVadis activities into a sustainable internal assessment methodology.
• Define the end-to-end workflow covering supplier onboarding, inherent risk screening, assessment, risk identification, remediation, acceptance, reassessment and offboarding.
• Develop and maintain TPRM procedures, assessment criteria, questionnaires, riskrating methodology, templates and supporting documentation.
• Define clear roles and responsibilities across Cybersecurity/GRC, Procurement, Legal, Business Owners and suppliers.
• Support definition of appropriate assessment tiers so that the depth of assessment is proportionate to supplier risk.
• Establish practical evidence requirements and criteria for determining when risks can be accepted, mitigated or escalated.
• Support transition of existing assessments, open risks and relevant historical information from the current model.
• Define operational KPIs/KRIs and reporting requirements to enable ongoing management oversight.
• Perform cybersecurity risk assessments of new and existing third parties.
• Review completed supplier security questionnaires and supporting evidence.
• Review evidence such as ISO/IEC 2701 certificates, SOC 2 reports, penetration test summaries, policies and other security assurance documentation.
• Identify control gaps and translate them into clear and actionable risk statements.
• Determine appropriate remediation actions and compensating controls.
• Follow up with suppliers and internal stakeholders to obtain missing information and close outstanding assessments.
• Escalate higher-risk suppliers and material residual risks through the defined risk governance process.
• Coordinate and prepare responses to cybersecurity questionnaires received from customers, partners and other external parties.
• Work with relevant internal subject-matter experts to validate responses and collect supporting evidence.
• Maintain a consistent and reusable repository of approved cybersecurity responses and evidence where appropriate.
• Identify questions that require escalation or specialist input rather than providing unsupported responses.
• Ensure responses accurately reflect implemented cybersecurity controls and approved company positions.

Governance & Continuous Improvement:

• Maintain appropriate records and evidence to provide an auditable trail of assessments, decisions, exceptions and risk acceptance.
• Support reporting on supplier risk exposure, outstanding assessments, remediation actions and overdue activities.
• Identify opportunities to automate or streamline the TPRM lifecycle.
• Ensure the process is scalable and risk-based rather than applying the same level of assessment to every supplier.
• Support knowledge transfer to the internal GRC team to ensure the process can be sustainably operated following the transition.