Senior Analyst – Technology Third-Party Risk Management (TPRM)
Location:
Campinas, BR
Role Overview
We are seeking a highly skilledSenior Analyst – Technology Third-Party Risk Management (TPRM)to support and strengthen our TPRM program. This role will work closely with the Information Security Governance, Risk & Compliance (GRC) team and cross-functional stakeholders to assess, monitor, and manage technology-related risks associated with third-party vendors.
Key Responsibilities
Perform comprehensiverisk assessments of third-party vendorsdelivering technology products and services.
Review and analyzevendor responses to cybersecurity and risk questionnaires, including evaluation of supporting documentation and evidence.
Identify, document, and communicatecontrol gaps and deficiencies, with a strong focus on risks impactingSOX (Sarbanes-Oxley) compliance.
Conducttechnology risk analysis, develop mitigation strategies, and track remediation efforts through to closure.
Evaluate and report onresidual risk levels, ensuring proper documentation and escalation of high-risk issues.
Support and executetechnology due diligence activitiesfor both new and existing vendors.
Collaborate with internal stakeholders (Procurement, Legal, Privacy, Architecture, and IT teams) to ensure vendor engagements meetinternal policies, regulatory requirements, and industry best practices.
Contribute to the continuous improvement of theTPRM framework, processes, and controls.
Required Qualifications
Proven experience inTechnology Third-Party Risk Management (TPRM)and vendor risk assessments.
Strong understanding ofcybersecurity frameworks(e.g., NIST, ISO 27001) and regulatory expectations.
Solid knowledge ofSOX IT General Controls (ITGCs)and their application to third-party service providers.
Hands-on experience intechnology risk analysis, remediation planning, and residual risk management.
Experience conductingtechnology due diligencefor vendors and service providers.
Excellentanalytical, communication, and documentation skills.
Ability to manage multiple priorities and workindependently in a fast-paced environment.