TPRM Analyst (Third Party Risk Management)

HGS; Bengaluru; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

HGS is seeking a Third-Party Risk Management professional in Bengaluru to conduct security and risk assessments across the vendor lifecycle. You will review SOC reports, ISO certifications, penetration test reports, and security questionnaires, and identify risks with actionable remediation guidance.

Collaborate with business, procurement, legal, privacy and technology teams to support onboarding and risk reviews.

Qualifications

• Bachelor’s degree in Information Security or related field.
• 3–6 years in Third-Party Risk Management or GRC.
• Familiarity with vendor risk assessment methodologies and security frameworks.
• Experience reviewing SOC reports, penetration tests, and certifications.

Responsibilities

• Conduct security and risk assessments of third-party vendors across lifecycle.
• Review security documentation including SOC reports, ISO certifications, penetration test reports, and security questionnaires.
• Identify security, privacy, compliance, and operational risks, and provide recommendations to address identified gaps.
• Partner with business owners, procurement, legal, privacy, and technology teams to support vendor onboarding and risk reviews.
• Track remediation activities and monitor risk treatment plans through completion.
• Maintain vendor risk assessments, risk ratings, exceptions, and supporting documentation within the TPRM platform.
• Perform periodic reassessments of critical and high-risk vendors in accordance with established review cycles.
• Support internal and external audits by providing TPRM-related evidence and documentation.
• Prepare risk summaries, metrics, and reports for management and key stakeholders.
• Contribute to the continuous improvement of the Third-Party Risk Management program, including processes, templates, and standards.

Skills

Analytical thinking

Documentation

Communication

Education

Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Risk Management, or related field

Tools

TPRM platforms

Job description

• Conduct security and risk assessments of third-party vendors throughout the vendor lifecycle.
• Review security documentation, including SOC reports, ISO certifications, penetration test reports, and security questionnaires.
• Identify security, privacy, compliance, and operational risks, and provide recommendations to address identified gaps.
• Partner with business owners, procurement, legal, privacy, and technology teams to support vendor onboarding and risk reviews.
• Track remediation activities and monitor risk treatment plans through completion.
• Maintain vendor risk assessments, risk ratings, exceptions, and supporting documentation within the TPRM platform.
• Perform periodic reassessments of critical and high-risk vendors in accordance with established review cycles.
• Support internal and external audits by providing TPRM-related evidence and documentation.
• Prepare risk summaries, metrics, and reports for management and key stakeholders.
• Contribute to the continuous improvement of the Third-Party Risk Management program, including processes, templates, and standards.

Preferred Qualifications

• Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Risk Management, or a related field.
• 3–6 years of experience in Third-Party Risk Management, Information Security, IT Audit, or Governance, Risk, and Compliance (GRC).
• Familiarity with vendor risk assessment methodologies and common security frameworks.
• Experience reviewing security documentation such as SOC reports, penetration tests, and compliance certifications.
• Strong analytical, documentation, and communication skills.
• Experience with TPRM or GRC platforms is an asset.
• Relevant certifications such as Security+, CISSP, CISM, CRISC, or CISA are considered a plus.