Analyst - Third Party Technical Assurance

Apex Group Ltd (UK Branch); Pune District; On-site; INR 1,500,000 - 2,500,000; Full time

Job summary

Apex Group Ltd (UK Branch) in Pune is looking for an IT & Cyber Technical Risk Assurance Manager to lead third-party technical risk assurance initiatives. You will be responsible for risk exposure management from outsourced services, cloud providers, and fintech partners.

The ideal candidate will possess over 10 years of experience in technical risk assurance within financial services, showcasing strong compliance knowledge and exceptional communication skills. This role is pivotal in ensuring robust vendor management and risk mitigation strategies.

Qualifications

• 10–15+ years in third-party technical risk assurance/TPRM within financial services.
• Hands-on experience with compliance regulations.
• Exceptional communication, presentation, and stakeholder influence skills.

Responsibilities

• Lead third-party/supplier technical risk assurance for banking/finance.
• Establish policy and procedures for third-party technical risk.
• Perform technical/security due diligence for onboarding.

Skills

Third-party technical risk assurance

DORA contractual clauses

GDPR DPAs

ISO/IEC 27001:2022

NIST CSF 2.0

Exceptional communication skills

Job description

Job Description: IT & Cyber Technical Risk Assurance Manager (Third Party / Supplier)

Role Overview

Lead third‑party/supplier technical risk assurance for banking/finance/hedge fund businesses, ensuring risk exposure from outsourced services, cloud providers, fintech partners, and critical ICT vendors is identified, assessed, controlled, and monitored in line with Cyber Strategy and Group CISO directives.

Design and operate a risk‑based Third‑Party Assurance (TPA) programme covering due diligence, onboarding, contractual security clauses, continuous monitoring, issue remediation, and offboarding/exit strategies. Provide decision‑ready inputs to the Technology Risk Forum (TRF) and manage regional expertise/stakeholder communication.

Key Responsibilities

• Third‑Party Risk Framework & Governance: Establish policy, standards, and procedures for third‑party technical risk; define tiers, inherent risk profiling, and control requirements based on service criticality and data sensitivity.
• Due Diligence & Onboarding: Perform technical/security due diligence (architecture, controls, certifications, testing); verify compliance to ISO/IEC 27001:2022, NIST CSF 2.0 outcomes, GDPR, DORA (EU) contractual obligations, EU AI Act responsibilities, PCI DSS for payment services, and COBIT‑aligned governance.
• Contractual & SLA Controls: Embed DORA ICT contractual clauses (where applicable), breach notification, resilience testing/TLPT, data location, logging/monitoring, vulnerability/patch SLAs, incident reporting timelines, and audit rights.
• Continuous Monitoring & Assurance: Operate ongoing assurance (attestations, evidence reviews, targeted testing, control sampling); monitor cyber events, SLA breaches, and material changes; trigger escalation and remediation.
• Third‑Party Resilience & Exit: Validate DR/BC/exit strategies; test data return/destruction; assess concentration risk; coordinate with procurement/legal for remediation and termination when required.
• Technology Risk Forum Inputs: Present supplier risk posture, top thematic third‑party risks, remediation progress, and decisions required (e.g., onboarding approvals, remediation funding, exception handling).
• Stakeholder Engagement: Partner with business owners, procurement, legal, privacy, security engineering, SOC, IT Ops, and regulators/auditors to ensure clear accountability and timely closure of actions.
• Regional Enablement: Harmonise assurance methods and reporting across countries; ensure cultural/regulatory nuances are addressed.
• Execute delegated tasks as deemed appropriate by the Group CISO and other empowered Group Cyber leadership authorities, ensuring timely and effective completion in alignment with organisational priorities.
• Support the Group Cyber Strategy end‑to‑end, driving alignment of all activities, decisions, and deliverables with strategic objectives and business outcomes.

Candidate Profile

• 10–15+ years in third‑party technical risk assurance/TPRM within financial services, including critical ICT providers and cloud services.
• Hands‑on experience embedding DORA contractual clauses, GDPR DPAs, ISO/IEC 27001:2022, NIST CSF 2.0 outcomes, EU AI Act responsibilities, PCI DSS, COBIT governance, and ISO 31000 risk treatment.
• Exceptional communication, presentation, articulation, and stakeholder influence skills; effective at supplier engagement and executive reporting.

Success Indicators

• Third‑party onboarding with complete due diligence and compliant contracts; clear risk decisions documented.
• Reduction in vendor‑origin incidents and SLA breaches; timely breach notifications and effective remediation.
• Audit/regulator confidence in supplier controls; strong evidence quality and continuous monitoring performance.
• Clear TRF narratives enabling funding/prioritisation and strategic decisions on vendors.