Third Party Risk Management (TPRM) Professional

UST; Chennai District; On-site; INR 900,000 - 1,500,000; Full time

Job summary

UST in Chennai is seeking a detail-oriented Information Security - Risk Analyst to support assessment, remediation, and continuous monitoring of cyber risks posed by external vendors and service providers. This role focuses on driving effective risk treatment plans and collaborating with internal stakeholders and vendors to remediate control gaps and reduce exposure in the supply chain.

You will drive risk treatment plans, coordinate with procurement, legal, and business teams to document

Qualifications

• Bachelor's degree in cybersecurity, IT or risk management.
• 3+ years in IT or cybersecurity risk management with vendor risk experience.
• Knowledge of NIST CSF, ISO 27001, SIG, SOC 2, CSA.
• Experience reviewing third-party security assessments and due diligence.
• Familiarity with GRC/TPRM platforms (Onspring, OneTrust, Archer, ServiceNow, Prevalent, BitSight, Panorays).
• Excellent communication and negotiation skills.

Responsibilities

• Analyze third-party security assessments to identify risk findings and determine treatment strategies (remediation, compensating controls, or acceptance).
• Collaborate with vendors, procurement, legal, and stakeholders to document and manage risk treatment plans based on due diligence and ongoing monitoring results.
• Track risk remediation activities and ensure timely execution.
• Maintain a centralized register of third-party risk treatment activities and ensure audit-ready documentation.
• Recommend compensating controls or alternative mitigation when direct remediation is not feasible.
• Escalate high-risk third-party issues and remediation delays to leadership.
• Contribute to enhancing third-party risk management frameworks, processes, and tools aligned with NIST CSF, ISO 27001, and regulatory requirements.
• Provide insights and reporting on risk trends, treatment status, and control effectiveness across the third-party portfolio.
• Support audit, regulatory, and internal assurance activities related to third-party cybersecurity risk.

Skills

Vendor risk management

Cybersecurity risk assessment

Third-party risk management

Communication

Negotiation

Education

Bachelor's degree in Cybersecurity, Information Technology, Risk Management, or related discipline

Tools

Onspring

OneTrust

Archer

ServiceNow

Prevalent

BitSight

Panorays

Job description

Job Summary

We are looking for a detail-oriented and strategic Information Security - Risk Analyst to support the assessment, remediation, and continuous monitoring of cyber risks posed by external vendors, partners, and service providers. This role plays a critical part in the third-party risk lifecycle, with a primary focus on driving effective risk treatment plans, collaborating with internal stakeholders and vendors to remediate control gaps and reduce exposure in the supply chain.

Responsibilities

• Analyze third-party security assessments to identify risk findings and determine appropriate treatment strategies (e.g., remediation, compensating controls, or acceptance).
• Collaborate with vendors, procurement, legal, and business stakeholders to document and manage risk treatment plans based on due diligence and ongoing monitoring results.
• Track and follow up on risk remediation activities, ensuring that treatment plans are executed within agreed timelines.
• Maintain a centralized register of third-party risk treatment activities and ensure all documentation is audit-ready.
• Recommend and support the implementation of compensating controls or alternative mitigation actions when direct remediation is not feasible.
• Escalate high-risk third-party issues and delays in remediation to leadership.
• Contribute to the enhancement of third-party risk management frameworks, processes, and tools, ensuring alignment with NIST CSF, ISO 27001, and regulatory requirements.
• Provide insights and reporting on risk trends, treatment status, and control effectiveness across the third-party portfolio.
• Support audit, regulatory, and internal assurance activities related to third-party cybersecurity risk.

Qualifications

• Bachelor s degree in Cybersecurity, Information Technology, Risk Management, or a related discipline.
• 3+ years of experience in IT or cybersecurity risk management, with specific experience in third-party or vendor risk.
• Strong knowledge of third-party risk management frameworks and control standards (e.g., NIST, ISO 27001, SIG, SOC 2, CSA).
• Hands-on experience reviewing third-party security assessments, risk questionnaires, and due diligence documentation.
• Familiarity with GRC or third-party risk platforms (e.g., Onspring, OneTrust, Archer, ServiceNow, Prevalent, BitSight, Panorays).
• Excellent communication and negotiation skills to work with internal and external stakeholders.