About the role
As our TPRM Analyst, you'll own the end-to-end vendor risk assessment lifecycle for our clients, from onboarding suppliers through assessment and scoring to remediation tracking and reporting. You'll work directly with client stakeholders to translate vendor risk into clear, actionable findings and with the suppliers themselves to drive remediation. This role reports directly to our COO.
Responsibilities:
- Conduct third-party/vendor risk assessments across our client base, using structured frameworks (NIST CSF, ISO 27002, NCSC CAF).
- Manage the assessment lifecycle end-to-end: intake, scoring, reporting, remediation, and sign-off.
- Work directly with client stakeholders to scope engagements and communicate findings.
- Engage with vendors directly to drive remediation of identified risks.
- Maintain and update supplier risk profiles and tiering.
- Produce clear, client-ready reports and executive summaries.
Requirements:
- Around 5 years' experience in TPRM, vendor risk, or third-party security assessment (flexible for the right candidate).
- Strong working knowledge of at least one recognized risk framework (NIST, ISO 27001/27002, NCSC CAF, or similar).
- Confident, clear communicator comfortable leading client conversations and challenging vendors on findings.
- Experience with a TPRM/GRC platform (e. g., Risk Ledger, OneTrust, Prevalent, or ProcessUnity) is a strong plus, but not essential.
- Relevant certifications (e. g., CTPRP, ISO 27001 Lead Auditor) are welcome but not required.