About this role
Development, delivery and oversight of third party information security assessments.
- Develop and implement third party information security risk assessment processes for all stages of the third-party lifecycle (requests for information, onboarding, continuous monitoring and offboarding).
- Integrate third party information security risk assessment processes within related processes.
- Create and maintain third party information security risk assessment questionnaires.
- Define and deliver a programme to regularly assess and monitor third party security.
- Identify, record and track third party risks.
- Review third party risk assessments to identify risk themes and trends such as supplier concentration risks.
- Review contractual security clauses and requirements.
- 5+ years’ experience of third party risk assessments.
- Strong understanding of industry recognized information security and data privacy standards such as Cyber Essentials, ISO 27001, NIST Cybersecurity Framework, GDPR, SOC2, CSA STAR, etc.
- Detailed working knowledge of information security controls (including cloud computing controls) and third party contractual security clauses.
- Ability to communicate effectively with a broad range of stakeholders, both internal and external, at all levels.
- Strong analytical and problem-solving skills, with excellent attention to detail.
- Definition and explanation of information security and third-party risks.
- Ability to reflect business drivers and risk appetite in third party risk assessments.
- Security certification such as CISSP, CISM, CRISC.