At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all. Senior Consultant – AI Third Party Risk Consultant Experience: 4–8 Years Role Summary The Senior Consultant – AI Third Party Risk Consultant is responsible for independently managing Third Party Security Assessment (TPSA) engagements across complex vendor ecosystems. The role demands deep expertise in TPRM frameworks, supply chain security, and risk lifecycle management, combined with active use of AI-enabled tools for vendor scoring, risk prediction, and control monitoring. The Senior Consultant provides technical depth to assessment delivery, contributes to methodology design, and supports junior analysts in executing high-quality risk evaluations across diverse industry sectors. Key Responsibilities <ul> <li style="font-size:10.0pt;font-family:arial, helvetica, sans-serif">Lead and independently execute Third Party Security Assessments (TPSA) across critical, high-risk, and strategic vendor portfolios.</li> <li style="font-size:10.0pt;font-family:arial, helvetica, sans-serif">Conduct comprehensive vendor due diligence including control gap analysis, regulatory compliance validation, and risk-tiered scoring.</li> <li style="font-size:10.0pt;font-family:arial, helvetica, sans-serif">Manage the full risk assessment lifecycle — from vendor onboarding due diligence through periodic reviews, escalation management, and exit risk assessments.</li> <li style="font-size:10.0pt;font-family:arial, helvetica, sans-serif">Design and refine vendor risk questionnaires, assessment frameworks, and scoring rubrics aligned to industry standards (ISO 27001, NIST CSF, SOC 2, DORA).</li> <li style="font-size:10.0pt;font-family:arial, helvetica, sans-serif">Perform supply chain risk analysis by identifying nth-party dependencies, concentration risks, and critical vendor failure scenarios.</li> <li style="font-size:10.0pt;font-family:arial, helvetica, sans-serif">Apply AI-enabled vendor risk scoring platforms to prioritize assessments and identify emerging threats.</li> <li style="font-size:10.0pt;font-family:arial, helvetica, sans-serif">Leverage predictive modelling and AI-assisted analytics to forecast vendor risk trajectories and recommend proactive controls.</li> <li style="font-size:10.0pt;font-family:arial, helvetica, sans-serif">Collaborate with procurement, legal, and business stakeholders to embed TPRM controls into vendor contracting and onboarding processes.</li> <li style="font-size:10.0pt;font-family:arial, helvetica, sans-serif">Prepare detailed risk assessment reports, risk ratings, and remediation recommendations for both technical and executive audiences.</li> <li style="font-size:10.0pt;font-family:arial, helvetica, sans-serif">Support the implementation of TPRM automation workflows and AI-driven continuous monitoring capabilities.</li> <li style="font-size:10.0pt;font-family:arial, helvetica, sans-serif">Mentor and guide Staff-level analysts, reviewing work quality and providing technical guidance.</li> </ul> Education / Certifications <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Bachelor’s degree in engineering, Technology, Business, Risk Management, or related disciplines.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Relevant certifications are advantageous (e.g., ISO 42001, CISSP, CISM, CRISC, ISO 27001 Lead Implementer, CTPRP, or equivalent).</li> </ul> AI & Cyber Certifications <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Cyber Security Certifications (Required / Advantageous): <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Certified Information Systems Security Professional (CISSP) – Broad cybersecurity expertise including risk management and third-party security.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Certified Information Security Manager (CISM) – Information security management and risk governance.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Certified in Risk and Information Systems Control (CRISC) – IT risk identification, assessment, and lifecycle management.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Certified Third Party Risk Professional (CTPRP) – Specialized certification in TPRM frameworks and vendor assessment practices.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">ISO/IEC 27001 Lead Implementer – Designing and implementing ISMS controls in vendor assessment contexts.</li> </ul> </li> </ul> <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">AI & Data Certifications: <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Microsoft Certified: Azure AI Engineer Associate (AI-102) – Designing and implementing AI solutions relevant to risk automation.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">AWS Certified Machine Learning – Specialty – Understanding ML pipelines applicable to risk scoring models.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Google Professional Machine Learning Engineer – ML model development and deployment for risk analytics.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Certified Artificial Intelligence Practitioner (CAIP) – Applied AI concepts across business and risk domains.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">ISACA Certified Data Privacy Solutions Engineer (CDPSE) – Data privacy risk and AI data governance.</li> </ul> </li> </ul> Skills & Experience Required Skills and Experience: <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">4–8 years of experience in third-party risk management, cyber risk, or information security consulting.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Proven experience executing end-to-end Third-Party Security Assessments across diverse vendor types (cloud, IT, operational).</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">In-depth knowledge of TPRM frameworks including NIST SP 800-161, ISO 27036, and sector-specific regulatory requirements.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Strong understanding of supply chain risk management including vendor tiering, concentration risk, and dependency mapping.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Use of AI in TPRM processes. Like using AI for assessor evaluation, writing issue descriptions and risk mitigation plans</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Understanding risk from third parties using AI to provide services to client. Looking into AI governance and AI security</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Understanding risk from third parties using AI Agents to provide services to client. Looking into AI governance and AI security</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Use of AI in TPRM processes. Like using AI Agents to build automations in TPRM processes</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Understanding how things like Frontier AI and Mythos will change cybersecurity Lense and how third parties are protecting themselves from these modern threats</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Experience managing the risk assessment lifecycle including risk identification, rating, mitigation planning, and remediation tracking.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Ability to conduct control gap analysis against ISO 27001, SOC 2, NIST CSF, CIS Controls, and PCI DSS.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Experience working with GRC platforms for workflow management and risk tracking.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Strong analytical, written, and presentation skills for technical and non-technical audiences.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Hands-on experience with AI-enabled vendor risk scoring tools and external threat intelligence platforms.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Exposure to predictive modelling techniques applied to vendor risk prioritization and breach likelihood scoring.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Understanding of AI-driven control monitoring frameworks and machine learning-improved continuous assessment cycles.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Familiarity with Graph AI concepts for mapping vendor networks and identifying supply chain concentration risks.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Awareness of NLP-based document analysis tools for automated questionnaire review and evidence validation.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Experience using data analytics and BI tools (Power BI, Tableau, Python) to build risk dashboards.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Knowledge of AI governance frameworks and ethical AI risk considerations relevant to vendor AI system assessments.</li> </ul> AI Tools Skillset <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Vendor Intelligence & Risk Scoring Platforms: <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">BitSight / Security Scorecard / RiskRecon – Active use for real-time vendor cyber ratings, issue tracking, and continuous monitoring feeds.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Prevalent / ProcessUnity / OneTrust VRM – End-to-end vendor risk assessment workflows, questionnaire management, and risk scoring.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">UpGuard – Vendor surface attack monitoring and data breach detection integrated into TPRM workflows.</li> </ul> </li> </ul> <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">AI-Enabled Assessment & Automation Tools: <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Coupa Risk Assess / Ariba Risk – AI-assisted supplier risk evaluation and procurement-integrated due diligence.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Armorblox / Darktrace – Awareness of AI-driven anomaly detection applicable to vendor environment assessments.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">ChatGPT / Microsoft Copilot for Risk – Drafting risk reports, summarizing vendor evidence, and accelerating assessment documentation.</li> </ul> </li> </ul> <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">GRC & Workflow Automation: <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">ServiceNow GRC / Archer – Risk workflow management, assessment tracking, and automated risk register maintenance.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Power Automate / Zapier – Automating vendor questionnaire distribution, evidence collection reminders, and reporting workflows.</li> </ul> </li> </ul> <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Data Analytics & Visualization: <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Microsoft Power BI / Tableau – Building vendor risk dashboards, heat maps, and trend analysis reports.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Excel Power Query / Python (Pandas) – Risk data cleansing, vendor scoring model inputs, and assessment data aggregation.</li> </ul> </li> </ul> Leadership & Behavioral Expectations <ul> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Deliver assigned assessment modules with quality, accuracy, and timeliness.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Collaborate effectively with cross-functional teams including procurement, legal, IT, and business stakeholders.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Demonstrate learning agility and proactively expand skills in AI-enabled risk management.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Support continuous improvement of TPRM methodologies, templates, and automation initiatives.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Communicate risk findings clearly and constructively to vendor stakeholders and internal clients.</li> <li style="font-size:10.0pt;font-family:'Times New Roman', serif">Show initiative in identifying process improvement opportunities and contributing to practice development.</li> </ul> EY | Building a better working world EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets. Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate. Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.

TC-CS-SRCR-Senior-Supply Chain and Third-Party Risk Management (Bengaluru, KA, IN, 560048) @ EY Global Services

About this role

Ready to apply?