Third Party InfoSec Risk Assessment - Manager - MFT - KGS CH

Development, delivery and oversight of third party information security assessments.

• Develop and implement third party information security risk assessment processes for all stages of the third-party lifecycle (requests for information, onboarding, continuous monitoring and offboarding).
• Integrate third party information security risk assessment processes within related processes.
• Create and maintain third party information security risk assessment questionnaires.
• Define and deliver a programme to regularly assess and monitor third party security.
• Identify, record and track third party risks.
• Review third party risk assessments to identify risk themes and trends such as supplier concentration risks.
• Review contractual security clauses and requirements.

• 5+ years’ experience of third party risk assessments.
• Strong understanding of industry recognized information security and data privacy standards such as Cyber Essentials, ISO 27001, NIST Cybersecurity Framework, GDPR, SOC2, CSA STAR, etc.
• Detailed working knowledge of information security controls (including cloud computing controls) and third party contractual security clauses.
• Ability to communicate effectively with a broad range of stakeholders, both internal and external, at all levels.
• Strong analytical and problem-solving skills, with excellent attention to detail.
• Definition and explanation of information security and third-party risks.
• Ability to reflect business drivers and risk appetite in third party risk assessments.
• Security certification such as CISSP, CISM, CRISC.