Sr. Associate - TPRM

Key Responsibilities

• Vendor Risk Assessments & Lifecycle Monitoring: Lead and support complex vendor risk assessments during onboarding, periodic reviews, and ongoing monitoring.
• Comprehensive Due Diligence & Risk Evaluation: Perform deep-dive vendor due diligence by reviewing questionnaires, policies, certifications, financial information, and supporting documentation, assessing risks across information security, cybersecurity, data privacy, business continuity, disaster recovery, regulatory and compliance, financial and operational, and subcontractor/fourth-party risk.
• Evidence Review, Deficiency Management & Risk Rating: Review and challenge evidence (such as SOC 1/2 reports, ISO 27001 certificates, penetration testing reports, business continuity plans, and privacy documentation), identify gaps, exceptions, and control deficiencies, document findings, negotiate remediation directly with vendors, assign or validate risk ratings based on established methodologies, track remediation activities, and follow up on outstanding issues.
• Records, Reporting & SLA Compliance: Maintain accurate vendor risk records, dashboards, assessment results, approvals, and supporting documentation; prepare risk summaries, metrics, and management reports; and ensure vendor assessments are completed within defined SLA/KPI timelines.
• Stakeholder Coordination & Audit Support: Coordinate efficiently with Procurement, Information Security, Privacy, Legal, Compliance, Business Owners, and other stakeholders, and support audits and regulatory reviews by providing necessary vendor risk documentation and evidence.
• Strategic Program Optimization & Compliance: Contribute to strategically improving and maturing vendor risk management processes, procedures, methodologies, and templates; act as an escalation point and work with MitraTech (Prevalent Tool) stakeholders; and ensure support for critical compliances like DORA.

Required Experience & Skills

• Education & Experience: Bachelor’s degree in Finance, Business, Risk Management, Legal, Information Security, IT, or a related field, backed by 10+ years of hands-on experience in Vendor Risk Management, Third-Party Risk Management (TPRM), Operational Risk, Compliance, IT Risk, or a related function.
• Core TPRM & Technical Knowledge: Deep understanding of TPRM principles, vendor lifecycle management, risk assessment, control evaluation concepts, and information security and privacy, supported by a strong ability to review, interpret, and challenge complex security/compliance documentation.
• Skills & Proficiencies: Strong analytical, problem-solving, and written/verbal communication skills to manage senior stakeholder expectations, alongside strong attention to detail, the ability to manage multiple complex assessments simultaneously, and proficiency in Microsoft Excel, Word, PowerPoint, and Outlook.

Preferred Qualifications (Nice-to-Have)

• Familiarity with frameworks such as NIST, ISO 27001, SOC 2, COBIT, PCI DSS, GDPR, or similar standards.
• Experience working with TPRM/GRC platforms such as ServiceNow, Archer, RSA, OneTrust, LogicGate, or similar tools.
• Certifications such as CRISC, CISA, Security+, ISO 27001, or relevant risk/compliance certifications are a plus.
• Experience in financial services, banking, insurance, healthcare, technology, or other regulated industries is advantageous.

The location

• Gurgaon,India

Our Benefits: Global vision, local impact

• At OSTTRA, our benefits philosophy offers a market-competitive package that reflects our position as an industry leader. We want to ensure you feel valued, secure, and empowered wherever you are in the world. Our approach is built on three core pillars:
• Global foundations : We provide a baseline of excellence across all our offices, focusing on comprehensive Health & Wellness, Financial Security, and Work-Life Balance. No matter your location, you are part of a culture that prioritizes your holistic well-being.
• Locally tailored: We benchmark in each market to ensure our packages are genuinely competitive where you live and work.
• Flexibility and growth: We empower you to work in a way that suits your life. This includes a hybrid working model, generous leave policies, and a commitment to your continuous professional development.

The Trust employee ownership plan

About OSTTRA

Equal opportunity employer statement at OSTTRA