GRC Vendor risk Third party risk assessment

GRC - Vendor risk assessment/ Third party risk assessment

Location: Remote

Duration: 6 months

Job Summary

We are seeking an experienced Cyber Security GRC Consultant with strong expertise in Third-Party/Vendor Risk Management and Security Assessments. The consultant will lead end-to-end vendor risk assessments, identify security and control gaps, and provide actionable remediation recommendations.

Key Responsibilities

• Lead end-to-end Third-Party/Vendor Risk Assessments across technology, SaaS, supply chain, cloud, and hybrid environments.
• Perform security reviews of applications, architectures, cloud solutions, and security controls.
• Conduct SOC 2 assessments and evaluate control design and operating effectiveness.
• Identify control gaps and recommend appropriate risk mitigation and remediation strategies.
• Ensure assessments align with SOC 2, ISO 27001, data security standards, and enterprise security policies.
• Manage risk lifecycle activities using GRC/risk platforms such as RSA Archer, Onspring, BitSight, UpGuard, SecurityScorecard, or ServiceNow.
• Partner with Legal, Procurement, IT, Privacy, Audit, and Security teams to drive assessments and remediation.
• Develop risk metrics, reports, and program insights for leadership.
• Communicate complex security and risk findings effectively to technical and non-technical stakeholders.