Key skills: GRC, TPRM, security, Vendor Risk Assessment, cyber Security, Data Security
Title: Security Engineer
Location: Remote
Duration: 6-12 Months
Skills: Cyber Security- GRC - Vendor Risk Assessment-Cyber Security - GRC - Data Security
Experience Required: 8-10 Years
MUST HAVE SKILLS: GRC - Vendor risk assessment/ Third party risk assessment
Role Overview:
The Information Security Engineer will support the Client’s Third-Party Risk Management (TPRM) and Governance, Risk, and Compliance (GRC) initiatives. This role requires a technically strong security professional who can independently assess vendor risk, evaluate control effectiveness, and align security practices with enterprise policies and cybersecurity best practices.
Key Responsibilities & Qualifications:
- Lead and execute end-to-end third-party/vendor risk assessments across technology, supply chain, SaaS, and hybrid environments, identifying control gaps and recommending risk mitigation strategies.
- Perform deep technical reviews of solution, application, and solution architectures, security controls, and cloud solutions from a security engineering perspective, translating findings into actionable remediation guidance.
- Conduct hands-on SOC 2 analysis, evaluate control design and operating effectiveness, and clearly articulate control gaps and risk impacts to stakeholders.
- Ensure alignment of third-party assessments and internal practices with enterprise security policies, data protection standards, and frameworks such as SOC 2 and ISO 27001.
- Leverage and administer GRC and risk intelligence platforms such as RSA Archer, Onspring, BitSight, UpGuard, SecurityScorecard, ServiceNow, or similar tools to manage risk lifecycle activities.
- Coordination with business partners such as Legal, Procurement, IT, Privacy, Audit, and Security Operations to drive timely assessment completion and remediation tracking.
- Develop and report meaningful risk metrics and program insights to leadership, demonstrating effectiveness and continuous improvement of the TPRM program.
- Contribute to the development, enhancement, and rationalization of information security policies, standards, and exception processes based on risk findings and industry best practices.
- Communicate complex technical and risk concepts clearly to both technical and non-technical stakeholders; build trusted relationships across business units.
- Operate independently in a fast-paced environment, managing multiple concurrent assessments while maintaining high-quality documentation and professional integrity.
- Must be a strong, clear, and concise communicator that is self-starting and can remain organized when faced with multiple assignments that require granular-level tracking.