Supplier Security Risk Analyst

The Supplier Security Risk Analyst plays a critical role in ensuring that third-party suppliers meet the organizations cybersecurity and compliance standards. This role supports the continuous assessment, monitoring, and governance of supplier-related security risks, contributing to the overall resilience of the digital supply chain.

Within the IT Risk, Compliance & Data Protection team, which is part of the Information Security & SecOps department, this role is implemented for addressing the following activities:

• Key Responsibilities

• Supplier Risk Assessment & Qualification

  • Conduct and document Supplier Inquiry Qualification (SIQ) and Supplier Inquiry for Procurement (SIP) processes
  • Perform risk assessments using tools such as Security Scorecard, BitSight, and Moodys
  • Evaluate supplier responses and determine risk treatment plans.

• Contractual Security Controls

  • Ensure integration of cybersecurity clauses, NDAs, and SIPs into supplier contracts in collaboration with Legal and Procurement
  • Support the definition and tracking of security KPIs in supplier agreements.

• Monitoring & Governance

  • Maintain and update the Supplier Security Risk Register.
  • Monitor supplier performance and risk posture through dashboards and periodic reviews
  • Coordinate with internal stakeholders to define response options for declining supplier risk scores

• Audit & Compliance

  • Support internal and external audits related to supplier security.
  • Ensure alignment with ISO 27001 controls (e.g., A.5.1, A.5.37) and internal ISMS processes

• Process Improvement & Reporting

  • Contribute to the continuous improvement of supplier risk management processes.
  • Prepare reports and dashboards for governance forums and risk boards

• Training & Awareness

• Promote awareness of supplier security requirements across business units.
• Support training initiatives related to supplier risk management tools and processes.