GRC Information Security Third‑Party Risk Assessment Specialist

Role Summary

The role involves managing Information Security Governance, Risk, and Compliance (GRC) with a strong focus on Third‑Party / Vendor Risk Assessments. The incumbent will ensure that vendors, service providers, and partners comply with applicable regulatory, industry, and organizational information security requirements.

Key Responsibilities

Third‑Party Risk Management (TPRM)

• Conduct end‑to‑end information security risk assessments of third parties, vendors, partners, service providers.
• Perform inherent risk profiling and residual risk evaluation while vendors onboarding, renewals and periodic reassessments
• Assist in updating Master Vendor Inventory as per service details and classification
• Review vendor‑provided information, security questionnaires, and supporting evidence
• Assess inherent security risks based on:
• Nature of services provided
• Type and sensitivity of data accessed, processed, or stored
• Degree of system and network access
• Regulatory and compliance impact
• Assign inherent risk ratings (e.g., High / Medium / Low) to new vendors as per the organization’s security risk framework
• Identify key risk drivers and control gaps at the inherent risk stage
• Document assessment results and rationale in the designated risk assessment template or system
• Perform detailed security risk assessments of third parties based on profiling criteria defined in the organization’s Security Risk Assessment Framework, including evaluation of service criticality, data sensitivity, access levels, regulatory impact, and inherent risk factors, to determine overall risk classification and required risk treatment actions.
• Coordinate with internal business stakeholders and vendor service owners to
• Collect and validate details related to vendor services and engagement scope
• Clarify data access, system integration, and service dependencies
• Identify, escalate, and report any issues, gaps, or support requirements impacting the risk assessment
• Provide periodic status updates on assessment progress, risks, and timelines to relevant stakeholders
• Assist in review and update of security risk framework for third parties
• Support to business units in updating vendor and its services related information
• Build and maintain relationships with internal stakeholders
• Track progress and closure of open observations as per defined remediation plan for each assessment
• Support in performing process related security assessments for the organization
• Identify gaps, document risk findings, recommend corrective actions, and track remediation closures.
  
  

• Work closely with:
• IT & Security teams
• Procurement & Legal
• Business units
• Vendors and external assessors
• Provide awareness and guidance on third‑party security and regulatory expectations.
  
  

• Strong understanding of:
• Information security controls
• Third‑party risk frameworks
• Regulatory compliance in BFSI
• Hands‑on experience with:
• Vendor security assessments
• Risk rating methodologies
• Compliance reporting
  
  

• Strong analytical and risk assessment skills
• Excellent documentation and report‑writing abilities
• Good stakeholder communication and negotiation skills
• Ability to work independently and manage multiple assessments