Grc Tprm Assessment And Remediation Sme

Tata Consultancy Services Limited; Sunnyvale (CA); A distancia; USD 90.000 - 140.000; Jornada completa

Descripción de la vacante

Tata Consultancy Services Limited in Sunnyvale, CA seeks an experienced Third-Party Risk Management (TPRM) Assessment and Remediation SME to manage the end-to-end lifecycle of supplier cybersecurity risk assessments in a fully remote, client-facing environment.

You will own CAPs end-to-end, coordinate with Legal, Procurement and InfoSec on remediation timelines, run a structured weekly leadership report, and escalate high-risk findings to client leadership with clear evidence.

Formación

• 5+ years in cybersecurity, TPRM, GRC operations, or supplier risk coordination.
• Working knowledge of NIST CSF, ISO 27001, SOC 2, SIG/CAIQ.
• Hands-on experience with GRC/TPRM tools (OneTrust, Archer, ServiceNow GRC, SupplierNinja, or similar).
• Proven ownership of high-volume, multi-step communication workflows with strict tracking/documentation.
• Excellent written communication for remote, client-facing engagement.
• Experience operating in distributed/remote teams.

Responsabilidades

• Supplier Inventory Management: maintain the Supplier Inventory in GRC platforms as the single source of truth for assessment status.
• Assessment Execution: evaluate suppliers against standard frameworks and validate evidence.
• Remediation Management: own CAPs end-to-end and drive closure with vendors and owners.
• Stakeholder Communication & Escalation: run structured outreach and escalate unresolved/high-risk findings.
• Weekly Reporting: deliver a standing weekly metrics report to leadership.

Conocimientos

Cybersecurity

GRC

Communication

Remote work

GRC tools

Herramientas

OneTrust

Archer

ServiceNow GRC

SupplierNinja

Descripción del empleo

We are seeking an experienced Third-Party Risk Management (TPRM) Assessment and Remediation Subject Matter Expert to manage the end-to-end lifecycle of supplier/vendor cybersecurity risk assessments and remediation - from inventory governance through assessment coordination, escalation management, and executive reporting - in a fully remote, client-facing environment. This role serves as the process authority for vendor risk assessments, findings management, and cross-functional remediation, requiring precise, proactive communication to maintain trust with high-visibility stakeholders.

Key Responsibilities

1. Supplier Inventory Management

• Maintain the Supplier Inventory (GRC platform, e.g., SupplierNinja) as the single source of truth for assessment status.
• Tier/filter suppliers requiring reassessment vs. new assessment per program criteria.
• Maintain accurate Direct Responsible Individual (DRI) records in the GRC tool (e.g., OneTrust).

2. Assessment Execution

• Evaluate suppliers against standard frameworks (SIG, CAIQ, NIST CSF, ISO 27001, SOC 2) and validate evidence (audit reports, certifications, pen test results).
• Confirm DRI ownership and obtain kick-off acknowledgement before initiating assessments.
• Log and track assessment tasks in a workflow tool (e.g., Wrike), including acknowledgement evidence.
• Confirm onsite-assessed suppliers have current-year coverage (e.g., in AirTable).
• Participate in recurring findings-review meetings (e.g., CSFA), advising on policy and evidence standards.

3. Remediation Management

• Own Corrective Action Plans (CAPs) end-to-end: define SLAs, track progress, drive closure with vendors and business owners.
• Coordinate with Legal, Procurement, and InfoSec on remediation timelines and compensating controls.

4. Stakeholder Communication & Escalation

• Run a structured outreach cadence with DRIs (kick-off 3 follow-ups 3 escalations to management).
• Track response/non-response rates for every outreach cycle.
• Escalate unresolved/high-risk findings to client leadership and track to closure.

5. Weekly Reporting

Deliver a standing weekly metrics report to leadership: outreach volume, response rates, follow-up/escalation status, suppliers approved for (re)assessment, and overall assessment/remediation coverage.

Required Qualifications

• 5+ years in cybersecurity, TPRM, GRC operations, or supplier risk coordination.
• Working knowledge of NIST CSF, ISO 27001, SOC 2, SIG/CAIQ.
• Hands-on experience with GRC/TPRM tools (OneTrust, Archer, ServiceNow GRC, SupplierNinja, or similar).
• Proven ownership of high-volume, multi-step communication workflows with strict tracking/documentation.
• Excellent written communication for remote, client-facing engagement.
• Experience operating in distributed/remote teams.

Preferred Qualifications

• Certification: CTPRP, CRISC, CISA, or CISSP.
• Experience with Wrike, AirTable, Jira, or similar tracking tools.
• Prior experience in regulated industries (financial services, healthcare, insurance).
• Track record producing leadership-facing weekly reporting.

Location : Sunnyvale, CA(In-Person Interview is must)

Salary Range : $90,000-$140,000 a year #LI-AS3

Location: Sunnyvale, CA

Function: TECHNOLOGY

Role: Senior Engineer

ID: 433974

Skills: Cyber Security | GRC

Salary Range: $90,000 - $140,000