Third Party Risk Management-Subcontractor

Birlasoft; Bengaluru; On-site; INR 1,200,000 - 2,400,000; Full time

Job summary

Birlasoft in Bengaluru, India is seeking a Senior professional to lead Third-Party Risk Management initiatives. The role covers vendor risk assessments, security posture reviews, and governance across global vendors.

You will perform due diligence, assess compliance with ISO 27001, NIST, and GDPR considerations, and collaborate with Procurement, Legal, IT, and Privacy teams to mitigate risks throughout the vendor lifecycle.

Qualifications

• 6+ years of experience in TPRM, vendor risk, cybersecurity risk, IT audit, or GRC roles.
• Strong understanding of the TPRM lifecycle and vendor risk frameworks.
• Hands-on experience with security assessments and control testing.
• Knowledge of cybersecurity concepts, access controls, incident response, and data protection.
• Excellent analytical, documentation, and stakeholder communication skills.
• Experience working with global vendors and cross-region stakeholders.

Responsibilities

• Conduct inherent and residual risk assessments for vendors across cybersecurity, data privacy, operational, and compliance domains.
• Perform vendor due diligence during onboarding and periodic reviews.
• Review vendor-provided evidence (SOC reports, ISO 27001, SIG, penetration test summaries, etc.).
• Assess vendor alignment with security frameworks such as ISO 27001, NIST, SOC 2, and HP internal security policies.
• Identify gaps, document findings, and recommend risk mitigation and remediation plans.
• Support compliance with global regulations (GDPR, data protection, internal audit requirements).
• Support the end-to-end third-party lifecycle: onboarding, ongoing monitoring, issue management, and off-boarding.
• Track vendor risks, remediation actions, and exceptions in GRC or risk management tools.
• Collaborate with Procurement, Legal, IT, Privacy, and Business stakeholders.
• Participate in internal audits, regulatory reviews, and risk governance forums.

Skills

TPRM experience

Vendor risk

Cybersecurity risk

IT Audit

GRC

Stakeholder communication

Job description

• 6+ years of experience in Third‑Party Risk Management, Vendor Risk, Cybersecurity Risk, IT Audit, or GRC roles.
• Strong understanding of the TPRM lifecycle and vendor risk frameworks.
• Hands‑on experience with security assessments and control testing.
• Knowledge of cybersecurity concepts, access controls, incident response, and data protection.
• Excellent analytical, documentation, and stakeholder communication skills.
• Experience working with global vendors and cross‑region stakeholders.

Area(s) of responsibility

Required Skills & Experience

• 6+ years of experience in Third‑Party Risk Management, Vendor Risk, Cybersecurity Risk, IT Audit, or GRC roles.
• Strong understanding of the TPRM lifecycle and vendor risk frameworks.
• Hands‑on experience with security assessments and control testing.
• Knowledge of cybersecurity concepts, access controls, incident response, and data protection.
• Excellent analytical, documentation, and stakeholder communication skills.
• Experience working with global vendors and cross‑region stakeholders.

Key Responsibilities

• Conduct inherent and residual risk assessments for vendors across cybersecurity, data privacy, operational, and compliance domains.
• Perform vendor due diligence during onboarding and periodic reviews.
• Review vendor‑provided evidence (SOC reports, ISO 27001, SIG, penetration test summaries, etc.).
• Assess vendor alignment with security frameworks such as ISO 27001, NIST, SOC 2, and HP internal security policies.
• Identify gaps, document findings, and recommend risk mitigation and remediation plans.
• Support compliance with global regulations (GDPR, data protection, internal audit requirements).
• Support the end‑to‑end third‑party lifecycle: onboarding, ongoing monitoring, issue management, and off‑boarding.
• Track vendor risks, remediation actions, and exceptions in GRC or risk management tools.
• Collaborate with Procurement, Legal, IT, Privacy, and Business stakeholders.
• Participate in internal audits, regulatory reviews, and risk governance forums.