We are looking for a Supply Chain Risk Management Specialist to join a leading financial organization and take a key role in managing third-party and vendor cybersecurity risks within its Cyber Defense Division.
This role involves leading a professional team, developing risk-based methodologies, overseeing vendor risk assessments, and ensuring compliance with cybersecurity policies and regulatory requirements.
What You'll Do:
- Lead and professionally manage the Supply Chain Risk Management Team.
- Drive the development and implementation of a risk-based Supply Chain Risk Management program across the organization.
- Define methodologies, processes, and controls for managing cybersecurity risks associated with vendors and service providers.
- Lead vendor risk assessments, including security reviews, questionnaires, due diligence, and findings analysis.
- Develop vendor classification and assessment models based on risk levels, service criticality, and business exposure.
- Lead risk mitigation activities, track remediation efforts, and ensure compliance with cybersecurity requirements.
- Develop and present risk reports, metrics, trends, and management dashboards.
- Collaborate with Procurement, Legal, Risk Management, Technology teams, and Business Units.
- Lead responses to regulatory and audit requirements related to third-party and supply chain risk management.
Requirements:
- At least 4 years of experience in Information Security, Cybersecurity, or Risk Management - Must.
- Experience in Third-Party Risk Management (TPRM) and/or Vendor Risk Management - Must.
- Experience conducting risk assessments, analyzing findings, and developing risk mitigation plans - Must.
- Familiarity with cybersecurity frameworks and standards such as ISO 27001, NIST, and CIS Controls - Must.
- Experience working with business stakeholders, technology teams, and control functions - Must.
- Strong analytical skills, strategic thinking, and the ability to translate risks into actionable recommendations.
- Strong leadership, communication, and stakeholder management skills.
- Relevant professional certifications such as CISM, CRISC, or CISSP - An advantage.
