Senior Third-Party Risk Management (TPRM) Consultant

About the role

The organization is looking for a Senior Third-Party Risk Management (TPRM) Consultant to lead and strengthen its third-party risk management framework. The role covers the full vendor lifecycle, from onboarding and due diligence through ongoing monitoring, remediation and reporting. It works closely with Procurement, Legal, IT, Security and business stakeholders.

Key responsibilities

• Lead and manage TPRM activities across the vendor lifecycle, including onboarding, due diligence, risk assessment, monitoring and offboarding.
• Conduct and oversee third-party security, privacy and compliance assessments, evaluating vendors against standards such as SOC 2, ISO 27001 and data protection requirements.
• Review security questionnaires, control evidence, audit reports and certifications to identify risks and control gaps.
• Perform risk scoring, control assessments, gap analysis and remediation tracking; define and maintain TPRM policies, risk-rating methodologies and assessment frameworks.
• Establish risk ratings, determine risk treatment and remediation requirements, and track remediation until risks are closed.
• Partner with Procurement, Legal, IT, Information Security, Compliance and business owners to embed third-party risk requirements in contracts and vendor engagements.
• Identify emerging third-party risks and recommend mitigations, and prepare risk reports, dashboards and management presentations.
• Communicate risk exposure and recommendations to senior management and contribute to continuous improvement of the TPRM program.

Required profile

• 10-15 years of overall professional experience, with 5-8 years in TPRM, vendor risk management or a closely related area.
• Strong hands-on experience managing third-party risk across the full lifecycle.
• Experience collaborating with Procurement, Legal, IT, Information Security, Compliance and business stakeholders.
• Preferred certifications: CRISC, CISM, CISSP, ISO 27001 Lead Implementer / Lead Auditor, and third-party risk management certifications.

Required skills

• Vendor security and compliance assessments, security questionnaires and evidence review.
• Risk scoring, gap assessments, remediation planning and risk acceptance/escalation.
• Knowledge of SOC 2, ISO 27001, data protection and privacy requirements.
• Ability to turn technical and security risks into clear business insights for senior management.