Third Party Risk Management (TPRM)

Overview

Own and govern Kyndryl's Third Party Risk Management (TPRM) program, leading vendor and partner security assessments within the Security & Resiliency practice.

What you'll do

• Own and govern the TPRM program, ensuring compliance with organizational security policies and regulatory requirements.
• Lead third-party risk assessments, evaluating vendors and partners for security posture, compliance, and potential exposure.
• Define the security processes for assurance, management, and compliance.
• Design and review business-driven information technology solutions and business processes to meet cybersecurity and regulatory requirements related to function, protection, assurance, risk management, and compliance.
• Establish and enforce TPRM policies, procedures, and risk frameworks across the organization.
• Review changing requirements and identify new risks, threats, vulnerabilities, potential anomalous flows, and interactions.
• Ensure that security subsystems and architectures for security in networks, infrastructure, middleware, applications, and systems and service management systems meet the business' needs.
• Integrate TPRM findings into VM, AppSec, and CSPM programs to provide a holistic enterprise risk view.
• Use vulnerability management processes to identify, evaluate, and prioritize vulnerabilities in computer systems, business processes, networks, and applications, and take steps to remediate or mitigate risks.
• Recommend modernization options, identify new business opportunities, and cultivate relationships with other teams and stakeholders.

What you'll need

• 7+ years of cybersecurity experience.
• Deep expertise in TPRM program management, vendor risk assessment, and regulatory compliance.
• Strong knowledge of cybersecurity, AppSec, cloud posture, and vulnerability management frameworks.
• Experience in team leadership, mentoring, and program governance.
• Proficiency with risk reporting tools, dashboards, and metrics tracking.
• Knowledge of global cyber threats, threat actors, and the tactics, techniques and procedures (TTPs) used by cyber adversaries.
• Experience conducting security and risk assessments using security frameworks (e.g., NIST, RMF, ISO, Common Criteria).
• Ability to adapt to changing security threats and technologies and stay updated with the latest security trends and best practices.
• Bachelor's degree in Computer Science, Information Security, or related field (required).

Nice to have

• Master's degree.
• Certifications: CRISC, CISA, ISO 27001 Lead Auditor, TPRM Practitioner/Certified Third-Party Risk Professional (CTPRP).

Details

• Location: Noida, India.
• Hybrid-friendly work culture.