Job Description

Third-Party (TP) risk reviewer performs risk assessments, review security policies and procedures, and conduct in-depth examinations of the TP's technical infrastructure, systems, and networks.

· Assess the effectiveness of security controls, such as access controls, encryption, incident response procedures, and disaster recovery plans.

· Third Party risk reviewer also evaluate the organization's compliance with relevant laws, regulations, and industry standards to ensure adherence and mitigate legal and regulatory risks.

· Provide detailed audit reports, communicate findings to TP, and work collaboratively with TP and TP engagement manager (TPEM) to provide corrective remediation actions for gaps of assessment report and determine whether TP can ultimately onboard and sign the service contract.

Roles and Responsibilities

? The Third-Party risk reviewer is responsible for assessing and evaluating the information security controls, policies and procedures of third parties and suppliers ("TP"). Their responsibility is to ensure that TP's information assets are adequately protected and aligned with industry standards, regulations and best practices. A third-party risk reviewer conducts a comprehensive audit to identify deficiencies, gaps and weaknesses in the TP security framework and provide recommendations for improvement.

Skills Required

? Excellent written and verbal English communication skills, able to work with various levels in the organization

? Familiar with computer network technology.

? Familiar with cyber security framework, such as NIST Cybersecurity Framework.

? Familiar with ISO 27001 / ISMS, and familiar with information security risk assessment framework.

? Familiar security practices and controls against specific requirements, such as SOC2, PCI DSS, GDPR, Information Security Classified Protection Standard(等保).

? Judge relevant materials and evidence with an objective and unbiased attitude.

? Ability to make timely and efficient decisions.

? Security certificates such as CISA, CISSP, ISO 27001 auditor is preferred.