TPRM- DPDPA

Deloitte Shared Services India; Mumbai; On-site; INR 800,000 - 1,400,000; Full time

Job summary

Deloitte Shared Services India is seeking a motivated Consultant with 2-4 years of experience in Third-Party Risk Management, Data Privacy, and GRC to support privacy and vendor risk engagements.

You will work on compliance assessments, risk assessments, policy development, and client deliverables, with exposure to DPIAs, RoPA, and ISO frameworks.

Join a team delivering governance and privacy programs for clients, with emphasis on collaboration and documentation.

Qualifications

• Supports privacy compliance engagements including DPIAs, RoPA, and data mapping.
• Performs risk and control assessments and governance documentation.
• Assists in vendor due diligence and third-party security/privacy risk assessments.
• Prepares client deliverables and participates in workshops and stakeholder discussions.

Responsibilities

• Support privacy compliance engagements, DPIAs, and data flow mapping.
• Contribute to TPRM vendor due diligence and third-party assessments.
• Assist governance, risk and compliance activities (ISO 27001/27701).
• Develop assessment reports, trackers and client deliverables.
• Participate in client workshops and interviews.

Skills

TPRM

Vendor Risk

Data Privacy

DPDPA/GDPR

Risk & Control Assessments

GRC/Compliance

ISO 27001/27701

Analytical/Documentation

Client/Stakeholder Interaction

Education

Bachelor's degree in Computer Science/Information Security/Engineering

Job description

Role Overview

We are looking for a motivated and detail-oriented Consultant with 2-4 years of experience in Third-Party Risk Management (TPRM), Data Privacy, and GRC. The candidate will support privacy and vendor risk consulting engagements, compliance assessments, risk assessments, and implementation of privacy and security frameworks.

The role requires hands-on exposure to TPRM/vendor assessments, data privacy compliance, risk and control assessments, governance documentation, and client-facing deliverables.

Key Responsibilities

Data Privacy

• Support DPDPA, GDPR, and other data privacy compliance and implementation engagements.
• Conduct Applicability Assessments, Gap Assessments, and Privacy Maturity Assessments.
• Support DPIAs, BIAs, Data Flow Mapping, and RoPA activities.
• Review business processes to identify personal data processing activities and privacy risks.
• Assist in developing privacy policies, standards, procedures, notices, and governance documentation.
• Support consent management, data retention, data classification, and data subject rights processes.
• Track remediation activities and prepare privacy compliance reports.

Third-Party Risk Management (TPRM)

• Support implementation and enhancement of TPRM frameworks and processes.
• Conduct vendor due diligence and third-party security/privacy risk assessments.
• Review vendor questionnaires and supporting evidence.
• Evaluate third-party risks and support development of appropriate mitigation measures.
• Support contract reviews from information security and privacy perspectives.
• Track third-party remediation activities and maintain assessment records.

Governance, Risk & Compliance (GRC)

• Support compliance assessments against DPDPA, ISO/IEC 27001, ISO/IEC 27701, and applicable regulatory requirements.
• Perform control assessments, gap assessments, and compliance reviews.
• Develop and review governance documents, policies, standards, and procedures.
• Prepare assessment reports, presentations, trackers, and client deliverables.
• Participate in client workshops, interviews, and stakeholder discussions.
• Gather and analyze business and technical information.
• Support project planning and timely delivery of assigned workstreams.

Mandatory Skills

• Third-Party Risk Management (TPRM)
• Vendor Risk / Vendor Due Diligence
• Data Privacy / Privacy Compliance
• DPDPA and/or GDPR
• Risk & Control Assessments
• GRC / Compliance Assessments
• ISO 27001 / ISO 27701
• Strong analytical, documentation, and communication skills
• Client/stakeholder interaction experience.

Good to Have

• Experience with DPIA, RoPA, Data Flow Mapping, BIA
• Privacy maturity or gap assessments
• Privacy/security questionnaires
• Contractual security & privacy reviews
• Experience with GRC/TPRM tools
• Privacy or information security certifications

Education

Bachelors degree in Computer Science, Information Security, Engineering, or a related field.