Third Party Security Advisor

:

• Coach and review Data Protection risk and control assessments, including Third-party Risk Assessment (TPRA).
• Monitor the progress and ongoing effectiveness of Data Protection controls at third parties in scope for Third Party Risk Management (TPRM).
• Monitor and if needed, coordinate actions to close the gaps, in cooperation with control owners and third parties.
• Ensure that control assessments (i.e. TPRA) are completed by third parties prior to due date and of high quality.
• Steward of Third Party Risk Management (TPRM) and Assessment (TPRA) relating to Data Protection (i.e. both Data Privacy and Security – in conjunction with SPAPM, ORM and Cyber Security team), policies, procedures and standards.
• Liaise with IT Security team to incorporate IT security controls within Data Protection library.
• Develop and provide training and awareness sessions for business, support units and third parties, where required.
• Present in Privacy Governance Forum (or a similar forum), and lead Working Groups to oversee Data Privacy improvements for third parties.
• Produce reports that highlight current effectiveness of key controls to mitigate data breaches, leakages or misuses at third party side, including ‘Path to Green’ reports.
• Review third party contracts needed to implement projects in partnership with the SPAPM and ORM, in order to ensure that Data Protection controls and risk mitigations are adequately in place.
• Monitor the effectiveness of Data Protection controls in third parties, including in-scope vendors and business partners, in coordination with control owners, e.g. IT Security, Legal, IT, SPAPM, and business/support units.
• Outreach and engagements with stakeholders, vendors and business partners for maintaining their awareness of hygiene and best practices in Data Privacy and Protection.
• Bridge the communication between business/support units and third parties (that handle Personal or Sensitive Data) to ensure that both parties understand the importance of Data Protection risks and controls, including remediation of key gaps as part contractual arrangement.

Requirements :

• Minimum 3 years experience in technology risk, including IT Audit or Information Security
• CISM / CISA / CISSP / ISO27001 Lead Auditor / CRISC
• Minimum 1 year in a lead or managerial position
• S1 (Bachelor Degree)