Assistant Manager, Third Party Technology Risk Management

Assistant Manager, Third Party Technology Risk Management at BNP Paribas

This role will be responsible for supporting the Third-Party Technology Risk Management team in identifying and evaluating potential/recognized risks related to Information Security, Business Continuity and Physical Security. The 3rd Party Security Risk Assessor, reporting to the Manager, Third Party Risk Management team, performs security assessments of vendors, service providers and 3rd party companies that manage systems or information for BNP Paribas.

Position Purpose

The Assistant Manager, Third Party Technology Risk Management will support the TPTRM team in identifying and evaluating potential and recognized risks concerning Information Security, Business Continuity, and Physical Security. This role specifically focuses on assessing vendor, service provider, and third-party company security that manage systems or information for BNP Paribas.

Responsibilities

Direct Responsibilities

• Perform third-party information and cyber security assessments to identify, monitor, remediate, and manage third-party risks across the third-party lifecycle.
• Apply good risk experience and technology expertise in areas such as information and cyber security, business continuity, incident management, compliance, and human resource security to accurately score the inherent risk profile of 3rd parties.
• Ensure risk assessments are completed on time with quality and prioritize workload effectively.
• Evaluate control effectiveness and review evidence of controls using knowledge of audit, compliance, security, and regulatory frameworks (e.g., ISO 27001, SIG, TruSight, SOC reports), including controls related to Privacy, Compliance, Business Resiliency, and Cyber.
• Collaborate with Line of Business partners, guiding them through the risk assessment lifecycle to ensure compliance with organizational requirements.
• Communicate assessment findings and recommendations to internal stakeholders, including senior management, legal, and compliance teams.
• Monitor and track identified findings throughout the assessment lifecycle.

Contributing Responsibilities

• Actively participate in identifying process gaps and take ownership of updating/documenting relevant TPTRM policies and procedures.
• Support internal and external TPTRM audit requirements.
• Compile and generate Weekly/Monthly/Quarterly dashboards on Key Performance Indicators (KPIs).

Technical & Behavioral Competencies

• Ideally, 5+ years of experience in TPRM or Risk Management background, preferably within financial services.
• Bachelor's degree with professional certification in Information, Cyber, Network, and Cloud Security.
• Experience with industry-recognized standards for IT security controls and best practices (e.g., NIST, ISO27001, PCI DSS, COBIT, SOC 2).
• Experience in one or more risk disciplines: Information Security, Business Continuity, Data Privacy.
• Experience with Governance, Risk & Compliance (GRC) tools is an advantage.
• Proficiency in providing stakeholders with specialist risk knowledge and monitoring its execution.
• Strong self-motivated multi-tasker who can prioritize competing tasks and stakeholders.
• Ability to work independently in a fast-adapting and agile work environment.
• Proactive and deliverable-focused, dedicated to meeting hard deadlines.
• Excellent analysis skills with a keen eye for detail.
• Strong capabilities in Microsoft Excel, PowerPoint, and Word.
• Familiarity with vendor management, procurement, and contract negotiation.
• Ability to communicate effectively with both technical and non-technical stakeholders.
• Strong analytical and problem-solving skills.

Specific Qualifications

• Certifications such as CTPRP, CISSP, CISA, CISM are a plus.
• Frameworks: ISO27001, NIST, GDPR, DORA, DPDP.

Technical Skills

• Risk identification, assessment, mitigation, monitoring.
• Security-framework knowledge: ISO 27001, NIST CSF, SOC 2, PCI-DSS, HITRUST and other industry standards.
• Regulatory & compliance expertise: GDPR, CCPA, FFIEC, HIPAA, local data-privacy laws, industry-specific mandates.
• Audit & GRC tooling: Experience with GRC platforms, questionnaire management, evidence-collection portals, and audit-trail documentation.

Behavioral Skills

• Ability to collaborate / Teamwork.
• Communication skills - oral & written.
• Attention to detail / rigor.
• Creativity & Innovation / Problem solving.

Education Level

Bachelor Degree or equivalent.

Location

MUMBAI, CHENNAI, BANGALORE.

Key skills/competency

• Third-Party Risk Management
• Information Security
• Cyber Security
• Risk Assessment
• Compliance & Regulatory Affairs
• Business Continuity
• GRC Tools
• ISO 27001 / NIST
• Data Privacy (GDPR, DPDP)
• Audit & Controls