Jr. GRC Engineer

Neurealm; Chennai District; On-site; INR 900,000 - 1,300,000; Full time

Job summary

Neurealm is seeking an experienced Third-Party Risk Management professional in Chennai to lead vendor risk assessments and governance across the vendor lifecycle. The role collaborates with Procurement, Legal, Information Security, Compliance, and Business teams to ensure effective risk management of external partners.

Ideal candidates have 2-4 years of relevant experience, strong ability to review SOC/ISO security artifacts, and hands-on experience with GRC platforms.

Qualifications

• 2-4 years of experience in Third-Party Risk Management / Vendor Risk Management
• Strong experience conducting vendor due diligence and risk assessments
• Experience reviewing SOC reports, ISO certifications, security questionnaires, and audit reports
• Experience interacting with senior stakeholders, vendors, and cross-functional teams
• Working knowledge of GRC frameworks and enterprise risk management practices

Responsibilities

• Lead end-to-end Third-Party Risk Management activities across the vendor lifecycle.
• Conduct inherent risk assessments and due diligence reviews for new and existing vendors.
• Evaluate vendor controls related to Information Security, Cybersecurity, Data Privacy, Business Continuity, Regulatory Compliance, and Operational Risk.
• Review and assess vendor security documentation, including SOC 1/SOC 2 reports, ISO 27001 certifications, penetration testing reports, and security questionnaires.
• Identify, document, and communicate vendor risks and recommended mitigation strategies.
• Track remediation plans and ensure timely closure of identified control gaps.
• Drive periodic vendor reassessments and continuous monitoring activities.
• Support contract reviews by identifying and recommending risk and compliance requirements.
• Develop and maintain TPRM policies, standards, procedures, and risk assessment methodologies.
• Produce risk reports, dashboards, and metrics for management and governance forums.
• Partner with internal stakeholders to ensure risk-informed vendor onboarding and management decisions.
• Governance & Risk Support (Secondary Focus):
• Support broader GRC initiatives, including risk assessments, policy reviews, and compliance activities.
• Maintain risk registers and support risk reporting processes.
• Assist during internal and external audits related to third-party risk controls.
• Contribute to the enhancement of risk governance frameworks and control environments.

Skills

Vendor risk management

Third-party due diligence

GRC frameworks

Stakeholder communication

SOC 1/SOC 2 review

ISO 27001 familiarity

Tools

ServiceNow GRC

Archer

MetricStream

OneTrust

ProcessUnity

Job description

Experience Required

2 - 4 years

Location

• Chennai, Tamil Nadu, India (CHN)

Job Summary

Job Summary

We are seeking an experienced Third-Party Risk Management (TPRM) professional with 2 to 4 years of experience in managing vendor risk programs, conducting third-party due diligence, and driving risk governance across the vendor lifecycle. The ideal candidate will have strong expertise in assessing and managing third-party risks across cybersecurity, operational resilience, privacy, compliance, and business continuity domains.

The role requires close collaboration with Procurement, Legal, Information Security, Compliance, and Business teams to ensure effective risk management of vendors and external partners. Exposure to Governance, Risk & Compliance (GRC) frameworks and risk management practices is desirable.

Key Responsibilities

• Lead end-to-end Third-Party Risk Management activities across the vendor lifecycle.
• Conduct inherent risk assessments and due diligence reviews for new and existing vendors.
• Evaluate vendor controls related to Information Security, Cybersecurity, Data Privacy, Business Continuity, Regulatory Compliance, and Operational Risk.
• Review and assess vendor security documentation, including SOC 1/SOC 2 reports, ISO 27001 certifications, penetration testing reports, and security questionnaires.
• Identify, document, and communicate vendor risks and recommended mitigation strategies.
• Track remediation plans and ensure timely closure of identified control gaps.
• Drive periodic vendor reassessments and continuous monitoring activities.
• Support contract reviews by identifying and recommending risk and compliance requirements.
• Develop and maintain TPRM policies, standards, procedures, and risk assessment methodologies.
• Produce risk reports, dashboards, and metrics for management and governance forums.
• Partner with internal stakeholders to ensure risk-informed vendor onboarding and management decisions.

Governance & Risk Support (Secondary Focus)

• Support broader GRC initiatives, including risk assessments, policy reviews, and compliance activities.
• Maintain risk registers and support risk reporting processes.
• Assist during internal and external audits related to third-party risk controls.
• Contribute to the enhancement of risk governance frameworks and control environments.

Required Qualifications

• 2 - 4 years of overall experience in Third-Party Risk Management / Vendor Risk Management.
• Strong experience conducting vendor due diligence and risk assessments.

Solid Understanding Of Third-party Risk Domains Including

• Cybersecurity Risk
• Information Security
• Data Privacy
• Operational Risk
• Regulatory & Compliance Risk
• Experience reviewing SOC reports, ISO certifications, security questionnaires, and audit reports.
• Experience interacting with senior stakeholders, vendors, and cross-functional teams.
• Strong risk analysis, reporting, and communication skills.

Preferred Qualifications

• Working knowledge of GRC frameworks and enterprise risk management practices.
• Familiarity with ISO 27001, NIST, SOC 2, COBIT and related control frameworks.
• Experience with TPRM/GRC platforms such as ServiceNow GRC, Archer, MetricStream, OneTrust, ProcessUnity or similar tools.
• Good to have certifications such as CRISC, CISA, CISSP, CISM, or CTPRP

Ideal Candidate Profile

A seasoned TPRM professional who has led vendor risk assessments and third-party governance programs, can independently engage with senior stakeholders, and possesses sufficient GRC knowledge to align third-party risk activities with the organization's overall risk and compliance framework. This role should ideally be 70-80% TPRM-focused and 20-30% GRC-oriented.