About the Role
As a Consultant – Manager in the cybersecurity domain, you will lead the design and maintenance of the Third-Party Risk Management (TPRM) framework. You will be responsible for implementing policies, processes, and procedures to assess and manage the cybersecurity risks associated with third parties. This role requires close collaboration with various stakeholders, including Cybersecurity, Procurement, Legal, and business units, ensuring a comprehensive approach to risk management throughout the third-party lifecycle.
Ready to apply for roles like this?
Unlock the company name and direct application link. Subscribers get instant access to fresh jobs across Dubai, Abu Dhabi and Riyadh, many with visa support.
Unlock employer & apply directly
Key Responsibilities
- Design and maintain the TPRM framework:
- Develop the cybersecurity risk management framework, including scoping and roles across various departments.
- Create and maintain third-party cybersecurity policies and procedures.
- Build a toolkit including tiered questionnaires, checklists, templates, and standard contract clauses.
- Integrate TPRM processes into procurement and contract management.
- Define and update TPRM KPIs and KRIs regularly.
- Run the third-party risk lifecycle:
- Assess third parties based on their inherent risk.
- Conduct due diligence prior to onboarding and contract renewals.
- Perform periodic reassessments and manage secure offboarding processes.
- Assess third parties:
- Issue and evaluate security questionnaires against required evidence.
- Review relevant compliance certifications and incident histories.
- Conduct assessments of high-risk suppliers using both remote and on-site methodologies.
- Evaluate cloud and SaaS providers against cybersecurity standards.
- Review suppliers’ external attack surfaces for additional evidence.
- Manage supply chain cybersecurity risks:
- Map critical supply chains and identify risks and vulnerabilities.
- Set software and hardware supply chain security requirements.
- Ensure critical suppliers have effective incident response plans and coordinate responses during breaches.
- Apply recognized cybersecurity frameworks to manage supply chain risks.
- Ensure contracts protect the organization:
- Define cybersecurity and data protection clauses in collaboration with Procurement and Legal teams.
- Review and refine contracts for high-risk suppliers to reflect relevant findings.
- Track, monitor, and report:
- Monitor supplier remediation actions and escalate unresponsive suppliers.
- Continuously assess critical suppliers for breaches and changes in service.
- Maintain third-party inventories and risk registers within TPRM platforms.
- Report on third-party and supply chain risk status to management.
Leadership Capabilities
- Builds own understanding of purpose and values for impactful contributions.
- Demonstrates commitment to personal development and attraction of top talent.
- Maintains accountability for performance tracking and personal goals.
- Develops effective communication and relationship-building skills.
- Understands the impact of individual work on broader team and business objectives.
Qualifications
- 2-8 years of experience in relevant fields.
- Bachelor’s degree in IT, Cybersecurity, or related discipline.
- Practical experience in vendor cybersecurity assessment.
- Experience designing or contributing to TPRM frameworks and policies.
- Ability to interpret and assess compliance documentation such as SOC 2 reports and ISO certifications.
- Understanding of supply chain risks and cybersecurity standards.
- Proficient written English for report and procedure documentation.
- Familiarity with TPRM platforms and security rating services.
- Experience assessing software and hardware supply chain controls.
- Background in IT audit or procurement risk management.
- Knowledge of relevant cybersecurity standards and frameworks.
- Proficiency in Arabic is a plus.
- Certifications like CTPRP, CISA, or ISO/IEC 27001 Lead Auditor are preferred.
Benefits
This role offers a competitive salary and benefits package, fostering an inclusive and collaborative work environment that supports personal and professional growth.
Contract Details
Location: Riyadh
Travel: Occasional travel may be required depending on project needs.
