Part Time - Contract - Advisor

Third-Party Risk Management (TPRM)

Cybersecurity Management Consulting

CGS CyberDefense is seeking an experienced Advisor - Third-Party Risk Management, Part-Time to support day-to-day operations of a client's Third-Party Risk Management program, including vendor intake, assessment coordination, stakeholder communication, and workflow management. The Advisor works alongside a junior team member and reports to the CGS engagement lead.

Responsibilities

• Support third-party cybersecurity risk assessments and vendor due diligence engagements across industries and regulatory environments

• Assist in developing and operationalizing TPRM frameworks, governance models, and operating procedures • Establish appropriate goals and objectives to deliver exceptional third-party risk management services in alignment with the client’s strategy and in support of client’s overall organization goals

• Foster collaborative working relationships with client’s security stakeholders and guide the team to provide exceptional customer experience

• Ensure third party assessment data integrity and quality control

• Regularly review and gain insights from data and metrics • Evaluate vendor control environments using assessments

• Support vendor segmentation, criticality classification, and continuous monitoring of risk profiles

• Support and optimize technology enablement for TPRM programs using platforms

• Coordinate communication between procurement, security, and compliance teams to enhance vendor governance

• Monitor and manage vendor risk assessment requests in accordance with established procedures

• Set up vendor records and coordinate assessment initiation and routing to appropriate stakeholders

• Track assessment progress and follow up with vendors and internal teams to ensure timely completion

• Trigger AI questionnaires when applicable and notify the Privacy team when a Privacy Risk Assessment is required

• Maintain and update program reporting and status dashboards in accordance with established reporting cadence

• Coordinate handoffs to designated risk reviewers upon completion of assessment activities

• Maintain all vendor risk management records, documentation, and status updates within the GRC platform

• Provide day-to-day guidance to a junior team member on third-party risk management processes and procedures

Qualifications

• 3-5 years of experience in cybersecurity, specifically third party risk management, or vendor/risk roles

• Solid understanding of third-party risk management concepts, due diligence processes, and control assessment methodologies

• Familiarity with frameworks and standards such as NIST CSF, ISO 27036, SOC 2, SIG, and shared responsibility models

• Strong communication, project management, and client advisory skills

• Experience working in a client-embedded or consulting environment - comfortable operating independently within a client's systems and processes • Proven experience successfully leading or mentoring others

• Excellent written and verbal communication with ability to explain complex issues to technical and non-technical users across the enterprise and to external parties

• Strong collaboration and coordination skills

• Proficient in Microsoft O365 products

Desired Experience

• Bachelor's degree in Information Security, Supply Chain Risk, Business, or related field • Hands-on experience with GRC platforms (ServiceNow Vendor VRM, OneTrust, Archer, etc)

• Knowledge of regulatory requirements impacting vendor risk (e.g., OCC, HIPAA, GDPR, CMMC)

• Strong analytical, reporting, and visualization skills (Excel, Power BI, or similar tools)

• Experience with continuous vendor monitoring tools (Black Kite, SecurityScorecard, etc)

• Familiarity with AI risk questionnaires or privacy risk assessment