Third-Party Risk Management - Cybersecurity

Job Description

GRC TPRM Assessment and Remediation SME

We are seeking an experienced Third-Party Risk Management (TPRM) Assessment and Remediation Subject Matter Expert (SME) to manage the end-to-end lifecycle of supplier/vendor cybersecurity risk assessments and remediation.

The role will be responsible for supplier inventory governance, assessment coordination, findings management, remediation tracking, escalation management, and executive reporting. The ideal candidate will have strong TPRM/GRC expertise, excellent communication skills, and experience managing high-volume, multi-step risk assessment workflows.

Location

Austin, TX / Cupertino, CA

Work Model

Hybrid – 3 Days a Week Onsite

Duration

12+ Months Contract

Key Responsibilities

1. Supplier Inventory Management

• Maintain the Supplier Inventory within the GRC platform as the single source of truth for assessment status.
• Tier and filter suppliers requiring reassessment versus new assessments based on program criteria.
• Maintain accurate Direct Responsible Individual (DRI) records within the GRC tool.

2. Assessment Execution

• Evaluate suppliers against established frameworks and standards, including:
• SIG
• CAIQ
• NIST CSF
• ISO 27001
• SOC 2
• Review and validate supplier evidence, including audit reports, certifications, penetration test results, and other security documentation.
• Confirm DRI ownership and obtain kick-off acknowledgement before initiating assessments.
• Log and track assessment tasks in workflow/tracking tools, including acknowledgement evidence.
• Verify that onsite-assessed suppliers have current-year assessment coverage.
• Participate in recurring findings-review meetings and provide guidance on policy requirements and evidence standards.

3. Remediation Management

• Own Corrective Action Plans (CAPs) from initiation through closure.
• Define remediation SLAs and track progress against established timelines.
• Drive remediation closure with suppliers and internal business owners.
• Coordinate with Legal, Procurement, and Information Security (InfoSec) teams regarding remediation timelines and compensating controls.
• Monitor open findings and ensure appropriate documentation and evidence are maintained.

4. Stakeholder Communication & Escalation

• Manage a structured outreach cadence with DRIs, including:
• Initial kick-off
• Follow-up communications
• Management escalations
• Track response and non-response rates for each outreach cycle.
• Escalate unresolved or high-risk findings to appropriate leadership.
• Maintain clear documentation of all communications, decisions, and remediation activities.
• Build and maintain strong relationships with business stakeholders and suppliers.

5. Weekly Reporting

• Prepare and deliver weekly metrics and status reports for leadership.
• Track and report:
• Outreach volume
• Supplier response rates
• Follow-up and escalation status
• Suppliers approved for new assessments or reassessments
• Assessment completion and coverage
• Open findings and remediation status
• Overall TPRM program progress

Required Qualifications

• 5+ years of experience in Cybersecurity, Third-Party Risk Management (TPRM), GRC Operations, Supplier Risk, or a related field.
• Strong working knowledge of:
• NIST CSF
• ISO 27001
• SOC 2
• SIG
• CAIQ
• Hands-on experience with GRC/TPRM platforms, such as:
• OneTrust
• RSA Archer
• ServiceNow GRC
• SupplierNinja
• or similar platforms
• Proven experience managing high-volume, multi-step communication and assessment workflows.
• Strong findings and remediation management experience.
• Excellent written and verbal communication skills.
• Strong documentation, organization, and follow-through skills.
• Experience working with distributed or remote teams.
• Ability to communicate effectively with business stakeholders, suppliers, and leadership.

Preferred Qualifications

• Relevant certification such as CTPRP, CRISC, CISA, or CISSP.
• Experience with workflow and tracking tools such as:
• Wrike
• Airtable
• Jira
• or similar platforms
• Experience working in regulated industries such as:
• Financial Services
• Healthcare
• Insurance
• Experience preparing leadership-facing metrics, dashboards, and weekly reports.
• Experience managing supplier cybersecurity assessments and remediation programs in a large enterprise environment.