TPRM

Deloitte Shared Services India; Pune District; On-site; INR 800,000 - 1,200,000; Full time

Job summary

Deloitte Shared Services India is seeking a Consultant with hands-on experience in Cyber Third-Party Risk Management (TPRM), IT risk assessments, IT audits, and information security. The role supports client engagements involving third-party risk assessments, ISMS assessments, and control reviews.

The ideal candidate will demonstrate strong stakeholder management, analytical skills, and the ability to work with cross-functional and global teams to identify gaps and implement remediation across

Qualifications

• Bachelor's degree in CS/IT/Engineering or related field.
• Hands-on experience in Cyber TPRM, IT risk assessments, IT audits, and information security.
• Experience with ISMS, audits, and control reviews.

Responsibilities

• Cyber TPRM & Third-Party Risk: conduct vendor risk assessments and review security controls.
• IT Risk & Audit: perform risk assessments, support ISMS assessments and information security reviews.
• Compliance & Stakeholder Management: liaise with Compliance, Audit, and Risk teams; communicate findings and remediation requirements.

Skills

Cyber TPRM

Vendor Risk

IT Risk Assessments

ISMS Assessments

Information Security

Regulatory Compliance

Documentation

Stakeholder Management

Cross-functional

Education

Bachelors in CS/IT/Engineering

Job description

Role Overview

We are looking for a Consultant with hands-on experience in Cyber Third-Party Risk Management (TPRM), IT Risk Assessments, IT Audits, and Information Security.

The candidate will support client engagements involving third-party/vendor risk assessments, ISMS assessments, IT audits, information security risk assessments, compliance requirements, and control reviews. The role requires strong stakeholder management, analytical skills, documentation capabilities, and the ability to work with cross-functional and global teams.

Key Responsibilities

Cyber TPRM & Third-Party Risk

• Conduct Cyber Third-Party Risk / Vendor / Supplier Risk Assessments.
• Assess third-party security and privacy risks and identify applicable controls.
• Review vendor security controls, processes, policies, and supporting evidence.
• Evaluate third-party risks and document gaps, observations, and recommendations.
• Support implementation and enhancement of Third-Party Risk Management frameworks.
• Document information security risks, compensating controls, and remediation recommendations.

IT Risk & Audit

• Conduct risk assessments and audits across people, process, and technology.
• Support IT audits, ISMS assessments, and information security reviews.
• Identify control gaps, risks, observations, and opportunities for improvement.
• Review and assess policies, processes, procedures, and security standards.
• Prepare detailed assessment/audit reports, risk registers, and management presentations.

Compliance & Stakeholder Management

• Liaise with client teams across Compliance, Audit, Information Security, Risk, and Regulatory functions.
• Understand and document applicable regulatory and compliance requirements.
• Participate in client discussions, workshops, and stakeholder interviews.
• Effectively communicate findings, risks, recommendations, and remediation requirements.
• Manage stakeholder expectations and deliver assigned workstreams within timelines.

Mandatory Skills

• Cyber Third-Party Risk Management (TPRM)
• Vendor / Supplier Risk Management
• IT Risk Assessments / Information Security Risk
• IT Audit / ISMS Assessments
• Third-Party Security Assessments
• Knowledge of Data Protection & Privacy risks in third-party environments
• Understanding of TPRM control frameworks
• Risk, control, gap, and compliance assessments
• Strong documentation and report-writing skills
• Excellent verbal and written communication
• Ability to work with cross-functional and global stakeholders.

Additional / Preferred Skills

• ISO 22301 implementation or audit experience
• Infrastructure Security
• Application Security
• Cloud Security
• Information Risk Management
• ISO 27001
• Security control assessments
• Regulatory/compliance assessments

Preferred Certifications

• CISA
• CISSP
• CISM
• CEH
• ISO 27001
• CBCI / CBCP
• ISO 22301 Lead Implementer / Lead Auditor
• OSCP

Education

Bachelors degree in Computer Science, Information Technology, Engineering, or a related field.