Third-Party Risk Specialist

Role purpose

Owns the third-party risk management programme: vendor classification, assessment

questionnaires, contract security clauses, and continuous monitoring. The build year stands

up the programme; the operate year runs the quarterly review cycle on the populated

register. The role grows in year two as the cadence ramps up.

Key activities

• Design the Third-Party Security Risk Management framework.

• Define vendor classification: critical, high-risk, medium, low.

• Build the vendor risk assessment questionnaire: access management, identity

governance, data protection, incident response, regulatory compliance, BCM, OT

and ICS controls.

• Standardise the contract security clause library: data protection, incident reporting,

right-to-audit, BCDR, vulnerability management, security patching.

• Design vendor offboarding: access revocation, asset return, data destruction

confirmation.

• Integrate vendor risk records with the existing GRC platform.

• Run the quarterly vendor review cycle once the register is populated.

• Produce vendor scorecards and present them to the Working Group.

Skills

• Third-party risk management methodology.

• Vendor contract review and security clause drafting.

• Continuous monitoring design for vendor risk.

• Vendor security assessment execution.

• Integration with procurement processes.

• Bilingual Arabic-English preferred for vendor engagement.

Experience

• Five years or more in third-party risk management or vendor security consulting.

• Implemented TPSRM at enterprise scale (200-vendor portfolio or larger).

• Experience with vendor risk modules in GRC platforms (Archer, ServiceNow Vendor

Risk, OneTrust, or similar).

• Contract security clause drafting experience.Qualifications

• ISO 27001 Lead Implementer preferred.

• CTPRP (Certified Third Party Risk Professional) or equivalent preferred.

• Bilingual Arabic-English preferred.

• Bachelor degree in computer science, information security, business, or related field.

Third Party Risk Specialist