Third Party Security Sr Advisor

:

• Monitor the progress and ongoing effectiveness of Data Protection controls at third parties in scope for Third Party Risk Management (TPRM).
• Ensure that control assessments (i.e. TPRA) are completed by third parties prior to due date and of high quality.
• Develop and provide training and awareness sessions for business, support units and third parties, where required.
• Monitor and if needed, coordinate actions to close the gaps, in cooperation with control owners and third parties.
• Coach and review Data Protection risk and control assessments, including Third-party Risk Assessment (TPRA).
• Steward of Third Party Risk Management (TPRM) and Assessment (TPRA) relating to Data Protection (i.e. both Data Privacy and Security – in conjunction with SPAPM, ORM and Cyber Security team), policies, procedures and standards.
• Present in Privacy Governance Forum (or a similar forum), and lead Working Groups to oversee Data Privacy improvements for third parties.
• Monitor the effectiveness of Data Protection controls in third parties, including in-scope vendors and business partners, in coordination with control owners, e.g. IT Security, Legal, IT, SPAPM, and business/support units.
• Outreach and engagements with stakeholders, vendors and business partners for maintaining their awareness of hygiene and best practices in Data Privacy and Protection.
• Review third party contracts needed to implement projects in partnership with the SPAPM and ORM, in order to ensure that Data Protection controls and risk mitigations are adequately in place.
• Bridge the communication between business/support units and third parties (that handle Personal or Sensitive Data) to ensure that both parties understand the importance of Data Protection risks and controls, including remediation of key gaps as part contractual arrangement.
• Produce reports that highlight current effectiveness of key controls to mitigate data breaches, leakages or misuses at third party side, including ‘Path to Green’ reports.
• Liaise with IT Security team to incorporate IT security controls within Data Protection library.

Requirements :

• S1 (Bachelor Degree)
• Minimum 3 years experience in technology risk, including IT Audit or Information Security
• Minimum 1 year in a lead or managerial position
• CISM / CISA / CISSP / ISO27001 Lead Auditor / CRISC