Manager - TPRM Role

EXL; Dadri, Gurugram District; Hybrid; INR 1,800,000 - 3,200,000; Full time

Job summary

EXL is seeking an experienced TPRM leader to manage end-to-end third-party risk lifecycle, including onboarding, due diligence, and periodic reviews. You will evaluate risks against ISO 27001, NIST, SOC 2, and GDPR, using Archer, Aravo, MetricStream, and ProcessUnity for assessments and reporting.

You will collaborate with internal teams and vendors to ensure compliance, monitor risk scores, and support audits and client engagements. 12 noon–12 midnight work window.

Qualifications

• Bachelor's degree in business, IT, risk management, finance, or related field.
• 9+ years of experience in TPRM or vendor risk management.
• Strong knowledge of ERM concepts and risk frameworks.
• Hands-on with TPRM platforms and regulatory standards (ISO 27001, SOC 2, NIST, GDPR, RBI).
• Experience with vendor risk assessments and due diligence.
• Proficiency in MS Office.

Responsibilities

• Manage end-to-end TPRM lifecycle including onboarding, due diligence, reviews, and risk assessments.
• Conduct vendor risk evaluations aligned with ISO 27001, NIST, SOC 2, GDPR.
• Use TPRM platforms for assessments and reporting.
• Collaborate with internal teams and vendors for compliance.
• Lead vendor risk monitoring, scoring updates, and detecting emerging risks.
• Analyze financial, operational, reputational risks of third parties.
• Prepare risk reports, dashboards, and stakeholder presentations.
• Support audit readiness and respond to audit queries.
• Support client engagements and timely risk reviews.
• Maintain trackers and documentation for all TPRM activities.

Skills

TPRM lifecycle management

Vendor risk management

Regulatory frameworks

Risk assessment methodologies

MS Office

Education

Bachelor's degree in Business/IT/Risk Management

Masters or relevant certifications preferred

Tools

Aravo

RSA Archer

MetricStream

ProcessUnity

Job description

Role & responsibilities

• Manage end-to-end Third-Party Risk Management (TPRM) lifecycle including onboarding, due diligence, periodic reviews, and risk assessments.
• Conduct vendor risk evaluations aligned with frameworks like ISO 27001, NIST, SOC 2, and GDPR.
• Utilize TPRM platforms such as Archer, ProcessUnity, and MetricStream for assessments and reporting.
• Collaborate with internal teams and vendors to ensure compliance with enterprise risk frameworks.
• Lead vendor risk monitoring efforts through periodic reviews, risk scoring updates, and detection of emerging risks.
• Analyze financial, operational, and reputational risks associated with third-party engagements.
• Prepare risk reports, dashboards, and presentations for stakeholders.
• Support audit readiness activities and respond to internal and external audit queries related to third-party risk.
• Support client-facing engagements and ensure timely completion of risk reviews.
• Maintain trackers and documentation for all TPRM activities.

Qualifications:

• Bachelors degree in business, Information Technology, Risk Management, Finance, or related field is mandatory; Masters degree or relevant certifications are strongly preferred
• 9+ years of experience in TPRM, vendor risk management, or related domains
• Strong understanding of third-party risk lifecycle management, enterprise risk management (ERM) concepts, risk frameworks and regulatory standards
• Hands-on knowledge of TPRM frameworks, risk assessment methodologies, and associated regulatory requirements (e.g., ISO 27001, SOC 2, NIST, GDPR, RBI Guidelines)
• Proven ability to conduct detailed vendor risk assessments, due diligence, and process improvement
• Experience with third-party risk management platforms (e.g., Aravo, RSA Archer, MetricStream) and proficiency in MS Office (Excel, PowerPoint, Word)
• Ability to manage multiple concurrent projects and work independently or as part of a team
• Provide strategic advice on TPRM program design and governance to senior leadership
• Experience in client-facing environments
• Certifications such as CTPRP, CISA, CRISC, or CISSP are preferred

Work Window: 12 noon - 12 midnight