Advisor - Third Party Risk Management (Contract)

Job Description

Part Time - Contract - Advisor

\n

Third-Party Risk Management (TPRM)

\n

Cybersecurity Management Consulting

\n

\n

CGS CyberDefense is seeking an experienced Advisor - Third-Party Risk Management, Part-Time to support day-to-day operations of a client's Third-Party Risk Management program, including vendor intake, assessment coordination, stakeholder communication, and workflow management. The Advisor works alongside a junior team member and reports to the CGS engagement lead.

\n

\n

Responsibilities

\n

• Support third-party cybersecurity risk assessments and vendor due diligence engagements across industries and regulatory environments

\n

• Assist in developing and operationalizing TPRM frameworks, governance models, and operating procedures • Establish appropriate goals and objectives to deliver exceptional third-party risk management services in alignment with the client’s strategy and in support of client’s overall organization goals

\n

• Foster collaborative working relationships with client’s security stakeholders and guide the team to provide exceptional customer experience

\n

• Ensure third party assessment data integrity and quality control

\n

• Regularly review and gain insights from data and metrics • Evaluate vendor control environments using assessments

\n

• Support vendor segmentation, criticality classification, and continuous monitoring of risk profiles

\n

• Support and optimize technology enablement for TPRM programs using platforms

\n

• Coordinate communication between procurement, security, and compliance teams to enhance vendor governance

\n

• Monitor and manage vendor risk assessment requests in accordance with established procedures

\n

• Set up vendor records and coordinate assessment initiation and routing to appropriate stakeholders

\n

• Track assessment progress and follow up with vendors and internal teams to ensure timely completion

\n

• Trigger AI questionnaires when applicable and notify the Privacy team when a Privacy Risk Assessment is required

\n

• Maintain and update program reporting and status dashboards in accordance with established reporting cadence

\n

• Coordinate handoffs to designated risk reviewers upon completion of assessment activities

\n

• Maintain all vendor risk management records, documentation, and status updates within the GRC platform

\n

• Provide day-to-day guidance to a junior team member on third-party risk management processes and procedures

\n

Qualifications

\n

• 3-5 years of experience in cybersecurity, specifically third party risk management, or vendor/risk roles

\n

• Solid understanding of third-party risk management concepts, due diligence processes, and control assessment methodologies

\n

• Familiarity with frameworks and standards such as NIST CSF, ISO 27036, SOC 2, SIG, and shared responsibility models

\n

• Strong communication, project management, and client advisory skills

\n

• Experience working in a client-embedded or consulting environment - comfortable operating independently within a client's systems and processes • Proven experience successfully leading or mentoring others

\n

• Excellent written and verbal communication with ability to explain complex issues to technical and non-technical users across the enterprise and to external parties

\n

• Strong collaboration and coordination skills

\n

• Proficient in Microsoft O365 products

\n

Desired Experience

\n

• Bachelor's degree in Information Security, Supply Chain Risk, Business, or related field • Hands-on experience with GRC platforms (ServiceNow Vendor VRM, OneTrust, Archer, etc)

\n

• Knowledge of regulatory requirements impacting vendor risk (e.g., OCC, HIPAA, GDPR, CMMC)

\n

• Strong analytical, reporting, and visualization skills (Excel, Power BI, or similar tools)

\n

• Experience with continuous vendor monitoring tools (Black Kite, SecurityScorecard, etc)

\n

• Familiarity with AI risk questionnaires or privacy risk assessment