Information Security Analyst – TPRM

Job Title:

Experience:

Location:

Open Positions:

Role Overview

Global Cybersec Capability Centre (G3C)

Third Party Risk Management (TPRM)

information security operations, risk management, and governance

Key Responsibilities

• Perform third-party risk assessments and audits for vendors and partners.
• Design and evaluate security controls in alignment with organizational policies.
• Act as SPOC for the TPRM team, coordinating with global function managers and local line managers.
• Conduct infosec audits, identify security risks, and recommend mitigation strategies.
• Develop and maintain security governance processes, policies, and standards.
• Monitor infrastructure security using third-party tools, ensuring control effectiveness.
• Support governance, regulatory, and compliance functions to align with global frameworks.
• Provide continuous assurance through risk evaluation, reporting, and control validation.
• Build effective working relationships across IT and business teams, ensuring risk awareness.
• Stay up-to-date with industry best practices, frameworks, and regulatory requirements.
  

Profile Requirements

• 4–6 years of experience in IT applications, infrastructure, risk management, or cybersecurity.
• Strong understanding of security governance, risk frameworks, and compliance requirements.
• Hands-on experience in risk assessments, vendor audits, and security evaluations.
• Knowledge of third-party risk management processes and tools.
• Strong problem-solving, decision-making, and analytical skills.
• Ability to work independently in semi-structured environments with ownership of deliverables.
• Excellent oral and written communication skills, with ability to engage senior executives.
  

Good to Have

• Experience with global compliance standards (ISO 27001, NIST, GDPR, SOC2, etc.).
• Familiarity with risk scoring methodologies and automation tools.
• Prior experience working in a banking/financial services security environment.
• Exposure to audit reporting and regulatory assessments.