TPRM Manager

Deloitte Shared Services India; Pune District; On-site; INR 900,000 - 1,200,000; Full time

Job summary

Deloitte Shared Services India is seeking a Consultant with hands-on experience in Cyber Third-Party Risk Management (TPRM), IT Risk Assessments, IT Audits, and Information Security. The role involves supporting client engagements in vendor risk assessments, ISMS assessments, IT audits, and information security risk reviews, with strong stakeholder management and cross-functional collaboration.

The candidate will document risks, controls, and remediation requirements, liaising with Compliance,

Qualifications

• Experience in Cyber TPRM, vendor risk, and IT risk assessments.
• Experience conducting IT audits and ISMS assessments.
• Strong documentation, reporting, and stakeholder management skills.

Responsibilities

• Conduct cyber third-party/vendor risk assessments and evaluate controls.
• Review and document third-party security controls, evidence, and gaps.
• Prepare risk assessments, audit reports, and management presentations.
• Engage with Compliance, Audit, Information Security, Risk, and Regulatory teams.

Skills

Cyber TPRM

Vendor Risk Management

IT Risk Assessments

Information Security Risk

IT Audit

ISMS Assessments

Third-Party Security Assessments

Data Protection & Privacy

TPRM Control Frameworks

Risk, Control, Gap & Compliance

Documentation & Reporting

Communication Skills

Education

Bachelor's degree in Computer Science/IT/Engineering

Job description

Role Overview

We are looking for a Consultant with hands-on experience in Cyber Third-Party Risk Management (TPRM), IT Risk Assessments, IT Audits, and Information Security.

The candidate will support client engagements involving third-party/vendor risk assessments, ISMS assessments, IT audits, information security risk assessments, compliance requirements, and control reviews. The role requires strong stakeholder management, analytical skills, documentation capabilities, and the ability to work with cross-functional and global teams.

Key Responsibilities

Cyber TPRM & Third-Party Risk

• Conduct Cyber Third-Party Risk / Vendor / Supplier Risk Assessments.
• Assess third-party security and privacy risks and identify applicable controls.
• Review vendor security controls, processes, policies, and supporting evidence.
• Evaluate third-party risks and document gaps, observations, and recommendations.
• Support implementation and enhancement of Third-Party Risk Management frameworks.
• Document information security risks, compensating controls, and remediation recommendations.

IT Risk & Audit

• Conduct risk assessments and audits across people, process, and technology.
• Support IT audits, ISMS assessments, and information security reviews.
• Identify control gaps, risks, observations, and opportunities for improvement.
• Review and assess policies, processes, procedures, and security standards.
• Prepare detailed assessment/audit reports, risk registers, and management presentations.

Compliance & Stakeholder Management

• Liaise with client teams across Compliance, Audit, Information Security, Risk, and Regulatory functions.
• Understand and document applicable regulatory and compliance requirements.
• Participate in client discussions, workshops, and stakeholder interviews.
• Effectively communicate findings, risks, recommendations, and remediation requirements.
• Manage stakeholder expectations and deliver assigned workstreams within timelines.

Mandatory Skills

• Cyber Third-Party Risk Management (TPRM)
• Vendor / Supplier Risk Management
• IT Risk Assessments / Information Security Risk
• IT Audit / ISMS Assessments
• Third-Party Security Assessments
• Knowledge of Data Protection & Privacy risks in third-party environments
• Understanding of TPRM control frameworks
• Risk, control, gap, and compliance assessments
• Strong documentation and report-writing skills
• Excellent verbal and written communication
• Ability to work with cross-functional and global stakeholders.

Additional / Preferred Skills

• ISO 22301 implementation or audit experience
• Infrastructure Security
• Application Security
• Cloud Security
• Information Risk Management
• ISO 27001
• Security control assessments
• Regulatory/compliance assessments

Preferred Certifications

• CISA
• CISSP
• CISM
• CEH
• ISO 27001
• CBCI / CBCP
• ISO 22301 Lead Implementer / Lead Auditor
• OSCP

Education

Bachelors degree in Computer Science, Information Technology, Engineering, or a related field.