Senior Third-Party Risk Management Consultant

Job description

The consultant will assess and manage risks throughout the full vendor lifecycle, from onboarding and due diligence to ongoing monitoring and offboarding. Works closely with procurement, legal, cybersecurity, compliance, and business teams to support vendor decisions. Responsibilities include planning and executing TPRM engagements, conducting inherent and residual risk assessments, performing risk‑based due diligence, evaluating security controls and governance, reviewing evidence and audit reports, maintaining risk registers and remediation plans, monitoring high‑risk vendors, and preparing management reports and executive presentations.

Requirements

• Strong experience in third‑party risk management (TPRM) including vendor due diligence, inherent and residual risk assessments, and risk‑based reviews throughout the vendor lifecycle
• Experience assessing cybersecurity, technology, operational, compliance, privacy, and business continuity risks associated with third parties
• Ability to evaluate vendor security controls using assessment responses, supporting evidence, audit reports, certifications, and independent assurance reports
• Experience managing vendor risk registers, findings, remediation plans, risk acceptance, and exceptions
• Knowledge of risks associated with cloud services, SaaS platforms, managed services, and other technology providers, including concentration and fourth‑party risk
• Experience assessing third‑party business continuity, disaster recovery, and operational resilience capabilities
• Familiarity with contractual risk requirements, including security clauses, SLAs, data protection obligations, audit rights, and incident notification
• Experience developing or improving TPRM frameworks, procedures, assessment methodologies, and reporting
• Knowledge of applicable NCA controls, privacy requirements, cybersecurity standards, and vendor risk regulations
• Fluency in Arabic and English (written and spoken).

Skills