Third Party Risk Management - Subcontractor

Birlasoft; Bengaluru; On-site; INR 900,000 - 1,300,000; Full time

Job summary

Birlasoft in Bengaluru, India seeks an experienced professional to lead third-party risk management and vendor risk activities. You will assess cybersecurity, data privacy, operational and compliance risks across a global vendor base, review security evidence, and align with ISO 27001, NIST, SOC 2, and internal policies.

The role requires strong analytical and stakeholder communication skills, collaboration with Procurement, Legal, IT, Privacy, and Business teams, and participation in audits and

Qualifications

• 6+ years of experience in TPRM, vendor risk, cybersecurity risk, IT audit, or GRC roles.
• Strong understanding of TPRM lifecycle and vendor risk frameworks.
• Hands-on with security assessments and control testing.
• Knowledge of cybersecurity concepts, access controls, incident response, and data protection.
• Experience collaborating with global vendors and cross-region stakeholders.

Responsibilities

• Conduct inherent and residual risk assessments for vendors across cybersecurity, data privacy, operational, and compliance domains.
• Perform vendor due diligence during onboarding and periodic reviews.
• Review vendor-provided evidence (SOC reports, ISO 27001, SIG, penetration test summaries, etc.).
• Assess vendor alignment with security frameworks such as ISO 27001, NIST, SOC 2, and HP internal security policies.
• Identify gaps, document findings, and recommend risk mitigation and remediation plans.
• Support compliance with global regulations (GDPR, data protection, internal audit requirements).
• Support the end-to-end third-party lifecycle: onboarding, ongoing monitoring, issue management, and off-boarding.
• Track vendor risks, remediation actions, and exceptions in GRC or risk management tools.
• Collaborate with Procurement, Legal, IT, Privacy, and Business stakeholders.
• Participate in internal audits, regulatory reviews, and risk governance forums.

Skills

Third-Party Risk Management

Vendor Risk

Cybersecurity Risk

IT Audit

GRC

Job description

Area(s) of responsibility

Required Skills & Experience

• 6+ years of experience in Third-Party Risk Management, Vendor Risk, Cybersecurity Risk, IT Audit, or GRC roles.
• Strong understanding of the TPRM lifecycle and vendor risk frameworks.
• Hands-on experience with security assessments and control testing.
• Knowledge of cybersecurity concepts, access controls, incident response, and data protection.
• Excellent analytical, documentation, and stakeholder communication skills.
• Experience working with global vendors and cross-region stakeholders.

Key Responsibilities

• Conduct inherent and residual risk assessments for vendors across cybersecurity, data privacy, operational, and compliance domains.
• Perform vendor due diligence during onboarding and periodic reviews.
• Review vendor-provided evidence (SOC reports, ISO 27001, SIG, penetration test summaries, etc.).
• Assess vendor alignment with security frameworks such as ISO 27001, NIST, SOC 2, and HP internal security policies.
• Identify gaps, document findings, and recommend risk mitigation and remediation plans.
• Support compliance with global regulations (GDPR, data protection, internal audit requirements).
• Support the end-to-end third-party lifecycle: onboarding, ongoing monitoring, issue management, and off-boarding.
• Track vendor risks, remediation actions, and exceptions in GRC or risk management tools.
• Collaborate with Procurement, Legal, IT, Privacy, and Business stakeholders.
• Participate in internal audits, regulatory reviews, and risk governance forums.