Third Party Risk Management - Subcontractor

Birlasoft Limited; Bengaluru; On-site; INR 4,200,000 - 6,000,000; Full time

Job summary

Birlasoft Limited in Bengaluru, India, is seeking a seasoned professional for Third-Party Risk Management and Vendor Risk roles. You will evaluate security controls, perform risk assessments, and drive remediation with cross‑functional teams.

You will review evidence (SOC, ISO 27001, SIG, pen tests), align vendor practices with ISO 27001, NIST, SOC 2, and HP security policies, and support GDPR/data protection and internal audits across global vendors.

Qualifications

• 6+ years of experience in Third‑Party Risk Management, Vendor Risk, Cybersecurity Risk, IT Audit, or GRC roles.

Responsibilities

• Conduct inherent and residual risk assessments for vendors across cybersecurity, data privacy, operational, and compliance domains.
• Perform vendor due diligence during onboarding and periodic reviews.
• Review vendor‑provided evidence (SOC reports, ISO 27001, SIG, penetration test summaries, etc.).
• Assess vendor alignment with security frameworks such as ISO 27001, NIST, SOC 2, and HP internal security policies.
• Identify gaps, document findings, and recommend risk mitigation and remediation plans.
• Support compliance with global regulations (GDPR, data protection, internal audit requirements).
• Support the end‑to‑end third‑party lifecycle: onboarding, ongoing monitoring, issue management, and off‑boarding.
• Track vendor risks, remediation actions, and exceptions in GRC or risk management tools.
• Collaborate with Procurement, Legal, IT, Privacy, and Business stakeholders.
• Participate in internal audits, regulatory reviews, and risk governance forums.

Skills

6+ years of experience in TPRM

TPRM lifecycle & vendor risk

Security assessments & control testing

Cybersecurity concepts & data protec.

Analytical, documentation & Stakeholde

Global vendor & cross-region collab

Job description

Area(s) of responsibility

Required Skills & Experience:

• 6+ years of experience in Third‑Party Risk Management, Vendor Risk, Cybersecurity Risk, IT Audit, or GRC roles.
• Strong understanding of the TPRM lifecycle and vendor risk frameworks.
• Hands‑on experience with security assessments and control testing.
• Knowledge of cybersecurity concepts, access controls, incident response, and data protection.
• Excellent analytical, documentation, and stakeholder communication skills.
• Experience working with global vendors and cross‑region stakeholders.

Key Responsibilities:

• Conduct inherent and residual risk assessments for vendors across cybersecurity, data privacy, operational, and compliance domains.
• Perform vendor due diligence during onboarding and periodic reviews.
• Review vendor‑provided evidence (SOC reports, ISO 27001, SIG, penetration test summaries, etc.).
• Assess vendor alignment with security frameworks such as ISO 27001, NIST, SOC 2, and HP internal security policies.
• Identify gaps, document findings, and recommend risk mitigation and remediation plans.
• Support compliance with global regulations (GDPR, data protection, internal audit requirements).
• Support the end‑to‑end third‑party lifecycle: onboarding, ongoing monitoring, issue management, and off‑boarding.
• Track vendor risks, remediation actions, and exceptions in GRC or risk management tools.
• Collaborate with Procurement, Legal, IT, Privacy, and Business stakeholders.
• Participate in internal audits, regulatory reviews, and risk governance forums.