Senior Consultant

wroots global pvt ltd; Bengaluru; On-site; INR 1,800,000 - 2,200,000; Full time

Job summary

wroots global pvt ltd is seeking a TPRM Specialist in Bengaluru to conduct risk-based third party due diligence, evaluating vendor financial stability, security, and regulatory compliance. The role requires partnering with Legal, Compliance, IT Security, Procurement, and senior management, and involves night shifts and WFO as noted.

Responsibilities include reviewing SOC 1/2, ISO reports, and controls, preparing audit-ready summaries, and maintaining records in the risk management system.

Qualifications

• Deep understanding of TPRM lifecycle activities.
• Knowledge of OCC 2023-17 guidance and regulatory expectations.
• Ability to assess risk across multiple domains.
• Experience reviewing SOC 1/2, ISO, penetration tests, and controls documentation.
• Strong written communication and risk-based decision making.

Responsibilities

• Perform initial and periodic due diligence on third party relationships based on risk and data sensitivity.
• Review financial statements, SOC reports, business continuity plans, security questionnaires, and licenses.
• Evaluate controls across information security, privacy, resilience, and regulatory compliance.
• Document gaps and risks in the risk management framework.
• Coordinate with stakeholders to obtain clarifications and remediation plans.
• Prepare audit-ready summaries and risk recommendations for governance.
• Support contract review by identifying risk-related requirements.
• Maintain records in the vendor risk system with outcomes and ratings.
• Manage multiple due diligence reviews to meet SLAs.
• Escalate material risks and support risk-based approvals.
• Use Process Unity for all due diligence assessments.

Skills

TPRM lifecycle

Regulatory knowledge

OCC guidance

Risk assessment

SOC/ISO reviews

Written communication

Stakeholder management

Process Unity

Tools

Process Unity

Job description

Skill: TPRM

Experience: 2-11 years

Budget: Max 20 LPA

Role Overview

Responsible for conducting risk-based third party due diligence reviews to evaluate vendor financial stability, operational resilience, information security, compliance posture, regulatory risk, and overall suitability to support the institutions business objectives. The role requires strong risk judgment, documentation discipline, and the ability to partner with business owners, subject matter experts, Legal, Compliance, Information Security, Procurement, and senior management.

Core Responsibilities

• Conduct initial and periodic due diligence reviews for third party relationships based on inherent risk, criticality, service type, data sensitivity, and regulatory impact.
• Review and assess third party documentation, including financial statements, SOC reports, business continuity and disaster recovery plans, information security questionnaires, insurance certificates, compliance attestations, licenses, certifications, and policy evidence.
• Evaluate third party controls related to information security, cybersecurity, privacy, business continuity, operational resilience, financial health, subcontractor oversight, regulatory compliance, and consumer protection obligations.
• Identify, document, and elevate due diligence gaps, control weaknesses, residual risks, and exceptions in accordance with the institutions third party risk management framework.
• Collaborate with business owners and subject matter experts to obtain clarifications, assess compensating controls, and determine whether remediation or enhanced monitoring is required.
• Prepare clear, audit-ready due diligence summaries, risk assessments, recommendations, and approval packages for stakeholders, governance committees, and senior leadership.
• Support contract review by identifying risk-related requirements, including service level expectations, audit rights, data protection provisions, regulatory access, termination rights, business continuity obligations, and subcontractor controls.
• Maintain accurate records in the third party risk management system, including review outcomes, risk ratings, issues, approvals, and ongoing monitoring requirements.
• Ability to manage multiple due diligence reviews simultaneously while meeting service level expectations and maintaining quality, consistency, and documentation standards.
• Sound judgment and decision-making skills, with the ability to elevate material risks, challenge incomplete responses, and support risk-based approval decisions.
• Proficiency with Process Unity - the master vendor repository that all due diligence assessments are conducted in.

Required Skills and Qualifications

• Strong knowledge of third party risk management lifecycle activities, including planning, due diligence, third party selection, contracting, ongoing monitoring, issue management, and termination.
• Understanding of financial institution regulatory expectations for third party risk management, including risk-based oversight, safe and sound operations, consumer protection, data security, and operational resilience.
• Familiarity with OCC Bulletin 2023-17 Interagency Guidance on Third-Party Relationships: Risk Management, including its risk-based expectations for due diligence, contract negotiation, ongoing monitoring, governance, and third party relationship life cycle management.
• Ability to assess third party risk across multiple domains, including operational risk, compliance risk, information security risk, privacy risk, financial risk, reputational risk, concentration risk, and strategic risk.
• Experience reviewing SOC 1, SOC 2, ISO certifications, penetration testing summaries, vulnerability management evidence, business continuity documentation, financial statements, insurance coverage, and regulatory compliance materials.
• Strong analytical skills with the ability to interpret complex documentation, identify control gaps, determine risk significance, and recommend practical mitigation actions.
• Excellent written communication skills with the ability to produce concise, professional, audit-ready due diligence narratives, risk rationales, executive summaries, and issue documentation using established templates based on vendor risk tier.
• Strong stakeholder management skills, including the ability to engage business owners, vendors, procurement, legal, compliance, information security, privacy, and operational risk teams.

Preferred Experience

• Prior experience in third party risk management, vendor risk management, operational risk, compliance, audit, procurement risk, or information security within a bank, mortgage servicer, credit union, fintech, or other regulated financial institution.
• Familiarity with regulatory guidance and industry frameworks related to third party risk, cybersecurity, privacy, business continuity, and operational resilience.
• Experience supporting governance forums, audit requests, regulatory examinations, management reporting, issue remediation, and policy or procedure enhancement.
• Professional certifications such as CTPRP, CTPRA, CRVPM, CISA, CRISC, CISSP, CAMS, CRCM, or other risk, compliance, audit.

Key Competencies

• Risk-based thinking and professional skepticism
• Regulatory awareness and control discipline
• Attention to detail and documentation accuracy
• Executive-level written and verbal communication
• Issue identification, escalation, and remediation tracking
• Cross-functional collaboration and vendor engagement
• Prioritization, time management, and SLA adherence
• Continuous improvement mindset and process standardization

Note-

We are looking for with candidate for US Mortgage and please dont source any candidate with Testing or IT Background for the same.

The above mentioned role involve WFO and Night Shifts