Senior Analyst - Third Party Technology

Overview

Senior Associate in Third Party Technology Assurance, managing and assessing risks from external technology vendors and service providers to safeguard operational resilience and regulatory compliance.

What you'll do

• Conduct comprehensive risk assessments of third-party technology vendors and service providers, evaluating security postures, technical controls, and compliance before onboarding and throughout the partnership lifecycle.
• Lead and support due diligence by gathering, reviewing, and analyzing documentation such as SOC1/SOC2 reports, ISO certifications, data protection agreements, and GDPR and other compliance artefacts.
• Continuously monitor third-party technology services for changes in risk profile, compliance status, or incidents, and maintain updated records and risk ratings with periodic re-assessment.
• Develop and update risk scoring models for technology vendors, and produce regular management reports and dashboards on risk trends, non-conformities, and remediation progress.
• Participate in identifying, escalating, and remediating incidents involving third-party technology services, coordinating with internal stakeholders on response and lessons learned.
• Review and advise on contract terms with technology vendors, ensuring security, confidentiality, and compliance clauses are embedded and enforceable.
• Contribute to developing, maintaining, and enhancing third-party risk management policies, standards, and guidelines aligned with NIST, ISO 27001, SOC 1, SOC 2, DORA, GDPR, and NCA.
• Work closely with procurement, legal, information security, compliance, and business teams to build awareness and understanding of third-party risks and controls.
• Assist in preparing for internal and external audits related to third-party technology risk, providing evidence, documentation, and subject matter expertise.
• Stay current with emerging risks, regulatory changes, and best practices in third-party technology risk and assurance.
• Execute delegated tasks as directed by the Group CISO and other Group Cyber leadership, and support the Group Cyber Strategy end-to-end.
• Meet delivery of all requirements from the Group Chief Information Security Officer and of the Group Cyber Strategy.
• Support the wider CISO function with GRC and Outsourcing requirements, where needed.

What you'll need

• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, Risk Management, or a related field.
• 6+ years of experience in technology risk management, third-party security assessments, or audit/assurance roles, preferably within financial services, healthcare, or other regulated industries.
• Understanding of IT infrastructure, cloud architecture, SaaS platforms, and data protection frameworks.
• Familiarity with common security controls and risk management methodologies.
• Solid knowledge of relevant regulations and standards such as GDPR, HIPAA, SOX, PCI DSS, NIST, and ISO 27001.
• Strong analytical skills to identify, assess, and mitigate complex technology risks, and to evaluate large amounts of information and make informed recommendations.
• Excellent verbal and written communication skills for preparing reports, presenting findings, and influencing stakeholders at all levels.
• Demonstrated ability to manage multiple priorities, meet deadlines, and adapt in a fast-paced environment.
• High degree of accuracy and attention to detail in reviewing documentation and risk artefacts.
• Effective team player with a proactive approach to cross-functional projects and initiatives.
• Eagerness to keep abreast of technological advancements, threat landscapes, and evolving assurance techniques.

Nice to have

• Professional certifications such as CISA, CISM, CRISC, or CISSP.
• Experience with third-party risk management platforms, GRC tools, and automation of risk assessment processes.
• Familiarity with project management methodologies and driving assurance initiatives from inception to completion.
• Ability to recommend and implement process improvements to increase the efficiency and effectiveness of third-party risk management.
• Confidence in negotiating with vendors to achieve favorable assurance and compliance terms.
• Experience delivering risk-related findings and assurance updates to senior management, boards, or external regulators.

Details

• Location: Pune, Viman Nagar.
• Typically reports to the Head of Technology Assurance.