Cybersecurity Third-Party Risk Management (TPRM) Consultant

Project Context

The client is seeking a highly hands-on cybersecurity professional to internalize and operate their Third-Party Cyber Risk Management (TPRM) process. The primary objective is to transition the supplier cyber risk assessment capability from an externally supported model to a newly defined, internally managed operating model. The successful consultant will hold dual responsibilities: finalizing the design and implementation of the new TPRM process, while simultaneously executing day-to-day supplier assessment activities during the transition period.

Key Responsibilities

• Finalize the design and document the end-to-end TPRM process and operating model.
• Define the supplier risk-tiering methodology, risk-rating frameworks, and escalation procedures.
• Develop internal cybersecurity assessment questionnaires, evaluation criteria, and templates for assessments, remediation, exceptions, and risk-acceptance.
• Define roles and establish a RACI matrix across GRC, Procurement, Legal, and business units.
• Establish a Reporting, KPI, and KRI framework for vendor risk tracking.
• Transition open assessments and risks from the legacy external process to the new internal model.
• Conduct hands-on supplier cyber risk assessments, reviewing security questionnaires and supplier evidence.
• Identify gaps, translate technical weaknesses into business risks, and support risk remediation, compensating controls, and exception management.
• Coordinate consistent responses to external cybersecurity questionnaires received from the client’s customers.
• Produce standard operating procedures (SOPs) and documentation to enable the internal team to operate the process long-term.

Required Skills & Experience

• Strong professional background in Third-Party Risk Management (TPRM), Cybersecurity Risk, Information Security, or GRC.
• Proven hands-on experience performing supplier cybersecurity risk assessments and reviewing evidence.
• Demonstrated experience designing, implementing, or significantly maturing a TPRM operating model.
• Ability to evaluate security controls and effectively translate technical vulnerabilities into clear business risk.
• Strong track record of managing remediation plans, policy exceptions, compensating controls, and residual-risk decisions.
• Deep understanding of common security and assurance frameworks, specifically ISO/IEC 27001, NIST Cybersecurity Framework, and SOC 2.
• Cross-functional collaboration experience working with Procurement, Legal, Cybersecurity, Privacy, and business stakeholders.
• Relevant industry certifications (e.g., CISSP, CISM, CRISC, ISO/IEC 27001 Lead Implementer/Lead Auditor, or equivalent).
• Ability to work autonomously to drive deliverables to closure with strong documentation and communication skills.

Preferred Qualifications

• Experience transitioning a TPRM capability from an outsourced/service-provider model to an internal operating model.
• Familiarity with European regulatory expectations regarding supply-chain cybersecurity, including NIS2.
• Experience utilizing TPRM or GRC workflow and automation platforms.