Third Party Risk Management Senior Associate

• About PwC’s Operate
  PwC’s Operate business delivers large operational and managed service solutions for clients to meet regulatory, risk and compliance challenges.
  With over 1,500 staff deployed on large implementation and execution programmes, Operate brings together top talent with a distinctive mix of knowledge and skills. We support clients in the delivery of large-scale operational programmes and managed solutions.
  We are looking for self-motivated and experienced information security individuals with experience in performing third party risk management activities such as supplier security assessments/reviews, contractual terms analysis and negotiation, and ongoing monitoring of supplier adherence to security commitments.

  You will need to demonstrate technical experience across the following areas of Cyber Security;

  • Knowledge of cloud computing environments
  • SaaS, PaaS and IaaS
  • Experience evaluating the associated organisational risks
  • Information Security assessment processes, including audit, vulnerability scanning, and security policy and standards review
  • Experience creating and managing IT security policies and standards. Sound understanding of penetration testing results
  • Understanding of Information Security fundamentals across multiple domains, including (but not limited to) security management, security architecture, application security, network security, access control, application development, operations security, physical security, cryptography, telecommunications and networking, business continuity planning, laws, investigations, and ethics

  Key responsibilities

  • Manage a large and diverse portfolio of Vendors for the firm
  • Evaluate and review third party vendor legal documentation and processes including Master Service Agreements (MSA's), Statement of Work (SOW's), Request for Proposal (RFP) and RFI (Request for Information) responses
  • Perform risk assessment on suppliers and identify control gaps
  • Negotiate remediation plan with suppliers
  • Maintain open communication channels with senior stakeholders through regular governance sessions, escalating appropriately as and when required.
  • Own the quality of all client outputs and ensure all client and internal document repositories are accurate and up to date

  Essential Criteria

  • Degree in Information Technology or related subject, or equivalent experience
  • Previous experience in professional roles involving information security and/or management
  • Knowledge of information risk and compliance principles. Broad understanding of security technology and related risk and compliance issues
  • Senior stakeholder relationship management
  • Excellent attention to detail and a passion for delivering high quality output for clients

  Desirable Criteria

  • Cyber Security related certifications including ISO27001 Lead Auditor, CISA, CISM, CIPP, CISSP
  • Strong understanding of information security controls & ISMS standards such as ISO27001/2, COBIT and NIST
  • Experience with SOC2 compliance standards

  What’s in it for you?

  This is an opportunity to join a growing team, bringing your experience and energy, to make a real difference at a local team level and to our clients. You will join a fun and faced paced environment that can provide you with a long term rewarding and stimulating career.
  You will work with a variety of clients across a range of different programmes providing you with the opportunity to see and try new things. We have a strong culture of business innovation, using technology and process improvement to automate the mundane and repeatable tasks. You will have an opportunity to get involved and work alongside our technology enablement teams to create positive change.
  
  You will benefit from a range of personal development support. This includes having access to our technical training pathways and personal skills training programmes delivered by our dedicated Operate Academy team. You will also have access to our Professional Qualification pathway that includes a wide range of industry recognised qualifications that can support your desired career direction, including; Chartered Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified Risk Information Systems Control (CRISC) and CompTIA Advanced Security Practitioner (CASP).

  The skills we look for in future employees

  All our people need to demonstrate the skills and behaviours that support us in delivering our business strategy. This is important to the work we do for our business, and our clients. These skills and behaviours make up our global leadership framework, ‘The PwC Professional’ and are made up of five core attributes; whole leadership, technical capabilities, business acumen, global acumen and relationships.

  Learn more here: www.pwc.com/uk/careers/experienced/apply

  Diversity
  Valuing Difference. Driving Inclusion.

  We work in a changing world which offers great opportunities for people with diverse backgrounds and experiences. We seek to attract and employ the best people from the widest talent pool because creating value through diversity is what makes us strong as a business, enabling us to solve important problems and deliver value to our clients. We encourage an inclusive culture where people can be themselves, are valued for their strengths and are empowered to be the best they can be. As an organisation with an increasingly agile workforce, we also support different ways of working offering flexible working arrangements. Learn more here about our work to support an inclusive culture.

  www.pwc.com/uk/diversity