third party risk analyst.

• collaborate with key stakeholders in the TPRM program to identify vendor due diligence requirements and ensure the status is current.
• capable of reviewing vendor due diligence materials (e.g., SOC1/SOC2, Vulnerability Scans, ISO 27001) to identify potential risks.
• knowledgeable in frameworks/standards such as NIST / ISO 27001 / SOX / MLPS etc
• able to comprehend vendor cybersecurity programs and identify gaps relative to internal company policy requirements.
• skilled in performing root cause analysis on identified issues and effectively explaining them to non-technical users.
• can clearly articulate the potential implications of cybersecurity risks to less technical stakeholders.
• capable of triaging use cases and prioritizing risks based on scope and impact.
• produce risk assessment reports and effectively communicate with vendors to implement remediation actions.

about the requirements

• a minimum of 3-5 years of relevant experience
• CISA/CISM certification or equivalent is desirable
• proficiency in Mandarin / Cantonese is an advantage
• expertise in IT Audit, Risk Assessment, Cybersecurity, NIST framework, SOC1, SOC2, and ISO 27001
• lead or senior experience is preferable

• hybrid working environment
• medical benefits
• performance bonus
• allowances