Job Summary
The TPRM Analyst will be responsible for supporting the organization’s third-party risk management program by identifying, assessing, monitoring, and reporting risks associated with vendors, suppliers, service providers, and other third-party relationships. The role requires collaboration with internal stakeholders such as Information Security, Legal, Compliance, Procurement, Business Owners, and Vendor Management teams to ensure third-party engagements meet the organization’s risk, security, privacy, regulatory, and operational standards.
Key Responsibilities
- Conduct third-party risk assessments during vendor onboarding, renewal, and periodic review cycles.
- Evaluate vendor responses to due diligence questionnaires and validate supporting evidence such as SOC reports, ISO certifications, penetration test summaries, business continuity plans, and security policies.
- Assess risks across information security, data privacy, regulatory compliance, operational resilience, financial stability, and business continuity domains.
- Assign and maintain vendor risk ratings based on established risk assessment methodologies and control frameworks.
- Identify control gaps, document findings, and work with vendors and internal stakeholders to track remediation plans through closure.
- Support contract and agreement reviews by identifying risk-related requirements such as audit rights, breach notification timelines, data protection provisions, service levels, and subcontractor controls.
- Maintain accurate third-party inventory records, risk registers, assessment documentation, and audit-ready evidence.
- Prepare dashboards, scorecards, and reports on vendor risk posture, assessment status, open issues, and remediation progress.
- Monitor third-party risk signals, including vendor incidents, changes in services, subcontractor usage, regulatory issues, and control changes.
- Participate in internal audits, regulatory reviews, and governance meetings related to third-party risk management.
- Contribute to the continuous improvement of TPRM policies, procedures, templates, workflows, and reporting practices.
Skill Requirements
2. Excellent Skills In Operational Risk Management, Process Optimization, And Incident Response Within Sap Landscapes.
3. Strong Leadership In Mentoring Teams On Sap Grc Best Practices And ComplianceDriven Operations.
4. Advanced Understanding Of Sap Authorization Concepts, Audit Controls, And Segregation Of Duties (Sod).
5. Excellent Communication And Stakeholder Management Skills.
Other Requirements
1. Optional but valuable: SAP Certified Technology Associate � SAP
- Vendor risk assessment and due diligence
- Risk identification, analysis, scoring, and reporting
- Information security and data privacy awareness
- Third-party lifecycle management
- Stakeholder coordination and vendor communication
- Audit readiness and evidence management
- Remediation tracking and issue management
- Strong written and verbal communication
- Attention to detail and ability to translate technical risks into business impact
Success Measures
- Timely completion of vendor risk assessments within defined SLAs.
- Accurate vendor risk ratings and well-documented assessment outcomes.
- Effective tracking and closure of risk remediation actions.
- Improved visibility into third-party risk posture through clear reporting and dashboards.
- Strong collaboration with business, procurement, legal, compliance, information security, and vendor teams.
System Security and Authorizations
2. Optional but valuable: SAP Certified Application Associate � SAP Access Control
3. Optional but valuable: ISACA Certified in Risk and Information Systems Control (CRISC