TPRM

Deloitte Shared Services India; Mumbai, Navi Mumbai; On-site; INR 700,000 - 1,000,000; Full time

Job summary

Deloitte Shared Services India is seeking a motivated Consultant with 2–4 years of experience in Third-Party Risk Management, Data Privacy, and GRC. The role involves supporting privacy and vendor risk engagements, compliance assessments, and governance documentation.

You will work on TPRM/vendor assessments, data privacy compliance, and risk and control assessments, delivering client-ready materials and reports to drive effective risk management.

Qualifications

• Experience in third-party risk management and data privacy engagements.
• Ability to perform risk assessments, control assessments, and governance reviews.
• Familiarity with DPDPA/GDPR, ISO 27001/27701, and privacy frameworks.

Responsibilities

• Support privacy and vendor risk consulting engagements.
• Conduct privacy/maturity and gap assessments; assist DPIAs/BIAs.
• Support vendor due diligence, risk assessments, and evidence reviews.
• Develop governance documents, policies, and client deliverables.
• Participate in client workshops and stakeholder discussions.

Skills

TPRM

Vendor Risk

Privacy Compliance

DPDPA/GDPR

Risk & Control

GRC

ISO 27001/27701

Analytical Skills

Stakeholder Mgmt

Education

Bachelors in CS/Info Sec/Engineering

Job description

Role Overview

We are looking for a motivated and detail-oriented Consultant with 2–4 years of experience in Third-Party Risk Management (TPRM), Data Privacy, and GRC. The candidate will support privacy and vendor risk consulting engagements, compliance assessments, risk assessments, and implementation of privacy and security frameworks.

The role requires hands-on exposure to TPRM/vendor assessments, data privacy compliance, risk and control assessments, governance documentation, and client-facing deliverables.

Key Responsibilities

Data Privacy

• Support DPDPA, GDPR, and other data privacy compliance and implementation engagements.
• Conduct Applicability Assessments, Gap Assessments, and Privacy Maturity Assessments.
• Support DPIAs, BIAs, Data Flow Mapping, and RoPA activities.
• Review business processes to identify personal data processing activities and privacy risks.
• Assist in developing privacy policies, standards, procedures, notices, and governance documentation.
• Support consent management, data retention, data classification, and data subject rights processes.
• Track remediation activities and prepare privacy compliance reports.

Third-Party Risk Management (TPRM)

• Support implementation and enhancement of TPRM frameworks and processes.
• Conduct vendor due diligence and third-party security/privacy risk assessments.
• Review vendor questionnaires and supporting evidence.
• Evaluate third-party risks and support development of appropriate mitigation measures.
• Support contract reviews from information security and privacy perspectives.
• Track third-party remediation activities and maintain assessment records.

Governance, Risk & Compliance (GRC)

• Support compliance assessments against DPDPA, ISO/IEC 27001, ISO/IEC 27701, and applicable regulatory requirements.
• Perform control assessments, gap assessments, and compliance reviews.
• Develop and review governance documents, policies, standards, and procedures.
• Prepare assessment reports, presentations, trackers, and client deliverables.
• Participate in client workshops, interviews, and stakeholder discussions.
• Gather and analyze business and technical information.
• Support project planning and timely delivery of assigned workstreams.

Mandatory Skills

• Third-Party Risk Management (TPRM)
• Vendor Risk / Vendor Due Diligence
• Data Privacy / Privacy Compliance
• DPDPA and/or GDPR
• Risk & Control Assessments
• GRC / Compliance Assessments
• ISO 27001 / ISO 27701
• Strong analytical, documentation, and communication skills
• Client/stakeholder interaction experience

Good to Have

• Experience with DPIA, RoPA, Data Flow Mapping, BIA
• Privacy maturity or gap assessments
• Privacy/security questionnaires
• Contractual security & privacy reviews
• Experience with GRC/TPRM tools
• Privacy or information security certifications

Education

Bachelor’s degree in Computer Science, Information Security, Engineering, or a related field.

Role Overview

We are looking for a motivated and detail-oriented Consultant with 2–4 years of experience in Third-Party Risk Management (TPRM), Data Privacy, and GRC. The candidate will support privacy and vendor risk consulting engagements, compliance assessments, risk assessments, and implementation of privacy and security frameworks.

The role requires hands-on exposure to TPRM/vendor assessments, data privacy compliance, risk and control assessments, governance documentation, and client-facing deliverables.

Key Responsibilities

Data Privacy

• Support DPDPA, GDPR, and other data privacy compliance and implementation engagements.
• Conduct Applicability Assessments, Gap Assessments, and Privacy Maturity Assessments.
• Support DPIAs, BIAs, Data Flow Mapping, and RoPA activities.
• Review business processes to identify personal data processing activities and privacy risks.
• Assist in developing privacy policies, standards, procedures, notices, and governance documentation.
• Support consent management, data retention, data classification, and data subject rights processes.
• Track remediation activities and prepare privacy compliance reports.

Third-Party Risk Management (TPRM)

• Support implementation and enhancement of TPRM frameworks and processes.
• Conduct vendor due diligence and third-party security/privacy risk assessments.
• Review vendor questionnaires and supporting evidence.
• Evaluate third-party risks and support development of appropriate mitigation measures.
• Support contract reviews from information security and privacy perspectives.
• Track third-party remediation activities and maintain assessment records.

Governance, Risk & Compliance (GRC)

• Support compliance assessments against DPDPA, ISO/IEC 27001, ISO/IEC 27701, and applicable regulatory requirements.
• Perform control assessments, gap assessments, and compliance reviews.
• Develop and review governance documents, policies, standards, and procedures.
• Prepare assessment reports, presentations, trackers, and client deliverables.
• Participate in client workshops, interviews, and stakeholder discussions.
• Gather and analyze business and technical information.
• Support project planning and timely delivery of assigned workstreams.

Mandatory Skills

• Third-Party Risk Management (TPRM)
• Vendor Risk / Vendor Due Diligence
• Data Privacy / Privacy Compliance
• DPDPA and/or GDPR
• Risk & Control Assessments
• GRC / Compliance Assessments
• ISO 27001 / ISO 27701
• Strong analytical, documentation, and communication skills
• Client/stakeholder interaction experience

Good to Have

• Experience with DPIA, RoPA, Data Flow Mapping, BIA
• Privacy maturity or gap assessments
• Privacy/security questionnaires
• Contractual security & privacy reviews
• Experience with GRC/TPRM tools
• Privacy or information security certifications

Education

Bachelor’s degree in Computer Science, Information Security, Engineering, or a related field.