Third Party InfoSec Risk Assessment - Manager - MFT - KGS CH
Description
Development, delivery and oversight of third party information security assessments.
Develop and implement third party information security risk assessment processes for all stages of the third-party lifecycle (requests for information, onboarding, continuous monitoring and offboarding).
Integrate third party information security risk assessment processes within related processes.
Create and maintain third party information security risk assessment questionnaires.
Define and deliver a programme to regularly assess and monitor third party security.
Identify, record and track third party risks.
Review third party risk assessments to identify risk themes and trends such as supplier concentration risks.
Review contractual security clauses and requirements.
5+ years’ experience of third party risk assessments.
Strong understanding of industry recognized information security and data privacy standards such as Cyber Essentials, ISO 27001, NIST Cybersecurity Framework, GDPR, SOC2, CSA STAR, etc.
Detailed working knowledge of information security controls (including cloud computing controls) and third party contractual security clauses.
Ability to communicate effectively with a broad range of stakeholders, both internal and external, at all levels.
Strong analytical and problem-solving skills, with excellent attention to detail.
Definition and explanation of information security and third-party risks.
Ability to reflect business drivers and risk appetite in third party risk assessments.
Security certification such as CISSP, CISM, CRISC.