Third-Party Risk (TPRM) Security Assessor

Quick Facts

• Role: Security Assessor (TPRM)

• Focus: Supplier information security assessments and reassessments

• Reporting: Manager, Information Security Governance

• Location: Poland (preferably Warsaw)

• Duration: Through 31 December 2026

• Start: ASAP

Description

Support Third-Party Risk Management (TPRM) by executing supplier security assessments and reassessments through the end of 2026. You will review supplier responses and evidence (e.g., documentation, certifications, audit reports), evaluate security posture and control gaps, and provide risk-based recommendations. You will also maintain assessment records in TPRM tools and help with audit readiness and evidence collection when required.

Responsibilities

• Conduct information security assessments of new and existing suppliers

• Review supplier responses, security documentation, certifications, audit reports, and evidence

• Assess supplier security posture, identify risks and control gaps, and provide risk-based recommendations

• Prioritize assessments based on supplier criticality and risk exposure

• Perform periodic supplier reassessments based on risk-based cycles

• Follow up on overdue assessments and remediation activities; track deadlines and escalate as needed

• Support continuous monitoring by reviewing changes in supplier security posture

• Serve as a security point of contact for internal stakeholders and suppliers; communicate requirements and outcomes

• Facilitate meetings/discussions and support resolution of assessment findings and clarifications

• Maintain accurate records of assessments, findings, and decisions within TPRM tools

• Support documentation quality and consistency; improve templates and workflows

• Assist with audit evidence collection and reporting activities

Requirements

• 2+ years of experience in Third-Party Risk Management (TPRM), Information Security/Cybersecurity Risk Management, and/or IT Audit or GRC

• Experience performing vendor/supplier security assessments

• Strong understanding of information security principles and control domains: Access Management, Vulnerability Management, Incident Response, Business Continuity, Security Monitoring, and Data Protection

• Experience reviewing security questionnaires and assurance reports such as SOC 2, ISO 27001, CAIQ, and SIG

• Excellent written and verbal communication skills in English

Benefits

• Contract engagement through 31 December 2026, supporting supplier security assessment operations, reassessment governance, and audit readiness activities.