TPRM Consultant – Vendor Risk Management (Contract)

About the role

We are seeking a TPRM Consultant with strong Governance, Risk, and Compliance (GRC) experience to design, implement, and operate a comprehensive third‑party risk management program. This is a project‑based, hourly contract focused on strengthening vendor oversight and preparing the organization for ISO 27001 certification.

Key responsibilities

• Develop an end‑to‑end TPRM program covering onboarding, risk assessments, performance monitoring, and off‑boarding.
• Support ISO 27001 audit readiness, conduct gap assessments, and track remediation.
• Create and maintain vendor risk registers, compliance trackers, and audit documentation.
• Design TPRM policy, procedures, and risk‑tiering methodology (critical, high, medium, low).
• Build vendor risk assessment templates aligned with SIG/CAIQ and DPIA triggers.
• Maintain vendor inventory, define workflows, and recommend standard security/privacy contract clauses.
• Execute the full vendor risk assessment lifecycle on defined cadences and continuously monitor risk posture.
• Coordinate with Legal, Procurement, IT, and Security on contract renewals, DPA updates, and sub‑processor changes.
• Prepare and present risk metrics and program status to leadership on a regular basis.
• Provide guidance and light training to internal stakeholders on TPRM processes.

Required profile

• Proven experience in Vendor/Third‑Party Risk Management.
• Solid background in GRC and information security compliance.
• Experience supporting ISO 27001 audit readiness and ISMS certification.

Required skills

• ISO 27001
• Information Security Management System (ISMS)
• SIG/CAIQ questionnaire development
• Data Protection Impact Assessment (DPIA) triggers
• Vendor risk assessment methodology