Third-Party Security Risk Management Specialist

AVENGA is a company hiring for a Senior-level cybersecurity role focused on third-party security risk management within large enterprise environments. The role involves collaboration with multiple internal and external stakeholders and adherence to governance and compliance frameworks.

• Minimum 5 years of professional experience in cybersecurity, information security, IT risk management, or related areas.
• Minimum 3 years of hands-on experience performing third-party security assessments, supplier security reviews, technology risk assessments, or similar activities.
• Demonstrated experience analyzing technical and security documentation and translating findings into actionable risk decisions.
• Experience working in large enterprise environments with multiple stakeholders and governance processes.
• Experience collaborating with external suppliers and managing security-related discussions and follow-up activities.
• Strong understanding of cybersecurity principles and risk management practices.
• Practical knowledge of Third-Party Risk Management (TPRM), supply chain security, and vendor risk assessment methodologies.
• Experience assessing security controls against recognized frameworks and standards including ISO 27001, NIST Cybersecurity Framework, SOC 2, NIS2, DORA, and CIS Controls.
• Understanding of AI governance, AI-related risks, and regulatory requirements such as the EU AI Act.
• Experience working with internal corporate security policies, standards, and compliance requirements.
• Strong analytical, problem-solving, and critical-thinking skills.
• Excellent written and verbal communication skills in English.

Nice to have:

• CISSP, SSCP, CISM, CRISC or equivalent cybersecurity certifications.
• ISO 27001 Lead Auditor, Lead Implementer or similar audit/compliance certifications.
• Experience contributing to the design, implementation or improvement of security governance and risk management processes.

• Perform security risk assessments of third-party suppliers, products, and services, including SaaS solutions, COTS applications, cloud services, hardware, and OT-related solutions.
• Review supplier responses, technical documentation, security reports, and supporting evidence to assess security posture and identify potential risks.
• Analyze identified risks, address points of non-compliance, and provide clear, risk-based recommendations.
• Engage directly with suppliers and internal stakeholders to clarify security, compliance, and risk-related matters.
• Act as a trusted advisor on third-party cybersecurity risks throughout supplier onboarding and lifecycle management processes.
• Collaborate with procurement, legal, compliance, business, and cybersecurity teams to ensure security requirements are appropriately addressed.
• Ensure assessments align with internal security standards, policies, and corporate requirements.
• Drive continuous improvement of the Third-Party Risk Management (TPRM) process, methodologies, and assessment practices.
• Identify process gaps, inefficiencies, and improvement opportunities, proposing and implementing corrective actions.
• Monitor emerging threats, regulatory requirements, and industry best practices to ensure the assessment framework remains effective and up to date.

Candidates must have excellent English communication skills. This role involves working within complex enterprise environments and international suppliers.