Third Party Risk Governance

Airtel Payments Bank; Gurugram District; On-site; INR 1,500,000 - 3,000,000; Full time

Job summary

Airtel Payments Bank is seeking an experienced risk professional to support its second line of defense with third-party risk governance. The role focuses on vendor risk assessments, regulatory compliance, ongoing monitoring, issue remediation tracking, and management risk reporting.

The ideal candidate has 5+ years in TPRM or related fields, with experience in banking/FS, and familiar with RBI outsourcing guidelines, ISO 27001, NIST, SOC reports.

Qualifications

• Minimum 5+ years in TPRM or related risk disciplines.
• Experience in Banking/FS/FinTech or regulated environments preferred.
• Certifications such as CRISC/CISA/CISSP are an advantage.

Responsibilities

• Manage and enhance the TPRM framework, policies, and governance processes.
• Oversee end-to-end third-party lifecycle including due diligence and monitoring.
• Maintain centralized repository of vendors and dependencies oversight.
• Conduct independent risk assessments across cyber security, privacy, ops resilience, and regulatory compliance.
• Review outsourcing and vendor arrangements for regulatory compliance.
• Coordinate risk evaluations with Procurement, Legal, IS/Compliance, and business teams.
• Manage incidents, escalations, and offboarding activities.
• Support audits/regulatory examinations and governance reporting.
• Track risk acceptance requests and escalate high-risk thresholds.
• Monitor KPIs and SLAs with vendor owners.

Skills

TPRM

Vendor Governance

Regulatory Compliance

Risk Assessment

Stakeholder Management

Information Security

Education

Bachelor's Degree

Risk Management

Cybersecurity

Tools

Archer

ServiceNow

GRC Tools

Job description

The role will support the Bank's second line of defense responsibilities and play a key role in overseeing third-party risk governance, regulatory compliance, vendor risk assessments, ongoing monitoring, issue remediation tracking, and management risk reporting etc. Please find below the proposed role requirements in detailed:-

Experience

• Minimum 5+ years of relevant experience in Third-Party Risk Management, Vendor Governance, Information Security Risk, Operational Risk, or Internal Audit.
• Prior experience in Banking, Financial Services, FinTech, or regulated environments preferred.

Key Responsibilities

• Manage and enhance the TPRM framework, policies, standards, and governance processes.
• Oversee the end-to-end third-party lifecycle, spanning vendor discovery, due diligence, risk scoring, contract risk clauses, ongoing monitoring, and offboarding/termination.
• Maintain an accurate, centralized repository of all third-party vendors, critical suppliers, and fourth party (subcontractor) dependencies oversight.
• Conduct independent risk assessments for vendors across cyber security, data privacy, operational resilience, financial stability, regulatory compliance, and business continuity domains.
• Review outsourcing & critical vendor arrangements and ensure compliance with applicable regulatory requirements.
• Coordinate with Procurement, Legal, Information Security or CISO, Compliance, and Business Teams for risk evaluations and contract governance i.e, SLA, incident etc.
• Manage third-party incidents, escalations, exception approvals, and vendor offboarding activities
• Support audits, regulatory examinations, management reporting, and governance committee updates.
• Review and manage risk acceptance requests or policy deviations, ensuring proper escalation to senior management or risk committees when high-risk tolerance thresholds are breached.
• Track identified vendor vulnerabilities, audit findings, or compliance gaps to closure, working closely with vendor relationship managers in the first line.
• Collaborate with business unit vendor owners to monitor key performance indicators (KPIs) and service-level agreements (SLAs).

Preferred Qualifications

• Bachelor's degree in Business Administration, Risk Management, Cybersecurity or related field.
• Professional certifications such as CRISC, CISA, CISSP, CTPRP, or equivalent would be an added advantage.
• Hands-on experience with GRC/TPRM platforms such as Archer, ServiceNow or similar GRC tools.
• Strong understanding of RBI Outsourcing Guidelines, Operational Risk Management, Information Security, ISO 27001, NIST, SOC reports, and regulatory compliance frameworks.

Key Competencies

• Strong analytical and risk assessment capabilities.
• Effective stakeholder management and communication skills.
• Ability to independently manage multiple assessments and governance activities.
• Experience in presenting risk insights and remediation status to senior management and governance forums.