Associate

About the Role

• Role Level: Associate
• Location: Gurugram, HR (5 Days in the Office)
• Function: Third-Party Risk Management, Vendor Risk, Supplier Risk and Compliance
• Stakeholder Coverage: India-based team supporting US, UK and global business stakeholders
• Work Schedule: Comfortable supporting UK shift and international stakeholder calls

Role Overview

• Seeking an experienced Third-Party Risk Management (TPRM) professional to manage and execute activities across the complete third-party lifecycle.
• The role will cover vendor onboarding, inherent and residual risk assessments, due diligence, compliance monitoring, remediation tracking, exception management, and management reporting.
• The candidate should be able to work independently with vendors, internal business owners, and global stakeholders, with strong preference for prior exposure to telecom, technology, or large vendor ecosystems.

Key Responsibilities

• Manage end-to-end TPRM activities across vendor onboarding, risk classification, due diligence, periodic reassessment, ongoing monitoring, and exit or termination support.
• Conduct and review inherent and residual risk assessments for third parties, including documentation of risk rationale, risk ratings, control gaps, and approvals.
• Perform due diligence across information security, cybersecurity, privacy, business continuity, disaster recovery, financial, operational, regulatory, compliance, and concentration risk domains.
• Review vendor questionnaires, evidence, certifications, attestations, policies, audit reports, and other supporting documentation to identify control gaps and follow-up actions.
• Assess third-party compliance against contractual, regulatory, organizational, and client-specific requirements, including SOW or contract clauses where applicable.
• Track remediation actions, exceptions, overdue items, and open risks to closure, while maintaining clear action owners, target dates, and escalation paths.
• Support ongoing monitoring and periodic reassessment of third parties based on risk tiering, criticality, service dependency, and materiality.
• Prepare TPRM dashboards, MIS packs, and management reports covering assessment status, key risks, overdue actions, SLA adherence, and remediation progress.
• Coordinate with procurement, legal, information security, privacy, business continuity, finance, compliance, and business teams to support timely completion of assessments.
• Contribute to process improvements, template enhancements, quality checks, and standard operating procedures for TPRM execution.

Requirements & Tech Stack

• Strong understanding of TPRM, Vendor Risk Management, Supplier Risk, and third-party lifecycle concepts.
• Good working knowledge of key vendor risk domains: information security, cybersecurity, data privacy, business continuity and disaster recovery, financial risk, regulatory and compliance risk, operational risk, and concentration or dependency risk.
• Ability to review vendor risk documentation, interpret evidence, identify control gaps, and articulate risk impact in a clear and business-friendly manner.
• Understanding of risk assessment methods, control testing concepts, risk scoring, risk ratings, and issue management workflows.
• Strong Excel and PowerPoint skills for data analysis, dashboards, MIS reporting, and senior management updates.
• Excellent written and verbal communication skills with proven ability to interact confidently with vendors, internal stakeholders, and US, UK or other global teams.
• Strong stakeholder management, follow-up discipline, and ability to manage multiple assessments simultaneously without compromising quality.
• High attention to detail and comfort working within defined SLAs, quality standards, and governance expectations.

Preferred Experience

• Experience in telecom, technology, consulting, shared services, or other vendor-intensive environments.
• Exposure to global stakeholder management, preferably with US or UK business teams.
• Experience using TPRM, GRC, procurement, case management, or workflow tools.
• Working knowledge of common frameworks and standards such as ISO 27001, SOC reports, NIST, GDPR, privacy regulations, business continuity standards or other relevant control frameworks.
• Experience reviewing contracts, SOWs, risk clauses, service criticality, subcontracting, cross-border data transfer, or termination-related risk considerations.