About This Role
This role focuses on ensuring that all information security aspects within the third-party risk management process are demonstrably complied with. You will monitor, assess, and refine risk analyses of external parties and applications, ensuring the correct security requirements are included and secured in contracts and documentation. The position also involves coordinating information requests and customer audits, advising on the feasibility of security requirements, and acting as a connecting link between various departments.
Responsibilities
- Assess whether external parties collaborating with KPMG meet information security standards through security assessments, due diligence, and validation of relevant documentation (e.g., ISO certifications, SOC reports, pentest results)
- Translate the outcomes of risk assessments into concrete security requirements and ensure these are documented in contracts, DPAs, SLAs, and other mandatory documents (including follow-up on missing measures)
- Structure the third-party risk management chain, including onboarding, risk classification, contracting, monitoring, periodic reviews, and exit scenarios, ensuring logical connections without overlap or gaps
- Demonstrate to clients and external stakeholders that KPMG's information security is in order, for example, by compiling assurance packages (e.g., ISO certifications, internal controls, client statements, or questionnaires) tailored to client needs
- Coordinate client audits and information requests, gather input from involved colleagues (e.g., IT, Legal, Assurance, Procurement, and Risk Management), and ensure complete, consistent, and timely responses
- Ensure security requirements are included and implemented in projects by collaborating with project teams, identifying risks, monitoring measures, and verifying their demonstrable execution and effectiveness
- Monitor, assess, and refine risk analyses of external parties and used applications performed by operational security teams
- Advise on the feasibility, acceptance, and potential mitigations of security requirements imposed by clients before contracts are signed
- Ensure processes run smoothly and security risks are demonstrably managed by conveying urgency, motivating colleagues, and building support
Requirements
- Five years of demonstrable work experience in performing, assessing, and substantiating risk analyses of external parties, including interpreting security documentation such as ISO certifications, SOC reports, pentest results, or due diligence questionnaires
- Experience in drafting, assessing, and refining contractual security provisions, such as DPAs, SLAs, data processing agreements, and security appendices, and aligning these with the risk profile of the collaboration
- Experience in coordinating client audits and information requests, gathering information from IT, Legal, Procurement, Risk Management, and other teams, and ensuring responses are correct, complete, and demonstrably accurate
