IT Vendor Manager

About This Role

This role focuses on ensuring that all information security aspects within the third-party risk management process are demonstrably complied with. You will monitor, assess, and refine risk analyses of external parties and applications, ensuring the correct security requirements are included and secured in contracts and documentation. The position also involves coordinating information requests and customer audits, advising on the feasibility of security requirements, and acting as a connecting link between various departments.

Responsibilities

• Assess whether external parties collaborating with KPMG meet information security standards through security assessments, due diligence, and validation of relevant documentation (e.g., ISO certifications, SOC reports, pentest results)
• Translate the outcomes of risk assessments into concrete security requirements and ensure these are documented in contracts, DPAs, SLAs, and other mandatory documents (including follow-up on missing measures)
• Structure the third-party risk management chain, including onboarding, risk classification, contracting, monitoring, periodic reviews, and exit scenarios, ensuring logical connections without overlap or gaps
• Demonstrate to clients and external stakeholders that KPMG's information security is in order, for example, by compiling assurance packages (e.g., ISO certifications, internal controls, client statements, or questionnaires) tailored to client needs
• Coordinate client audits and information requests, gather input from involved colleagues (e.g., IT, Legal, Assurance, Procurement, and Risk Management), and ensure complete, consistent, and timely responses
• Ensure security requirements are included and implemented in projects by collaborating with project teams, identifying risks, monitoring measures, and verifying their demonstrable execution and effectiveness
• Monitor, assess, and refine risk analyses of external parties and used applications performed by operational security teams
• Advise on the feasibility, acceptance, and potential mitigations of security requirements imposed by clients before contracts are signed
• Ensure processes run smoothly and security risks are demonstrably managed by conveying urgency, motivating colleagues, and building support

Requirements

• Five years of demonstrable work experience in performing, assessing, and substantiating risk analyses of external parties, including interpreting security documentation such as ISO certifications, SOC reports, pentest results, or due diligence questionnaires
• Experience in drafting, assessing, and refining contractual security provisions, such as DPAs, SLAs, data processing agreements, and security appendices, and aligning these with the risk profile of the collaboration
• Experience in coordinating client audits and information requests, gathering information from IT, Legal, Procurement, Risk Management, and other teams, and ensuring responses are correct, complete, and demonstrably accurate
• Strong communication skills in both Dutch and English, capable of bridging the gap between your field and colleagues in other disciplines, explaining complex matters in understandable and convincing language
• Good insight into all relevant components of third-party risk management, such as onboarding, risk classification, security requirements, monitoring, annual reviews, exit management, and documentation obligations
• Relevant completed HBO (higher professional education) or WO (university) degree, such as Risk Management, Cybersecurity, Cybercrime, Information Security Management, or a comparable domain
• Affinity with (generative) AI and motivated to actively apply this technology in daily work

Benefits

• Variable performance bonus
• Fixed expense allowance
• Fixed work-from-home allowance per day worked
• 30 vacation days (on a full-time basis) and the option to buy or sell additional days
• Fully equipped home office
• Reimbursement of travel expenses with an NS business card or travel allowance
• Laptop and iPhone
• Extensive range of training and education programs for professional and personal development
• Diversity networks (pride, gender, ability, cultural diversity, and generations) that regularly organize activities to celebrate difference
• Focus on vitality, including sports at the Amstelveen office or discounts on local gyms, plus access to coaching, health, and vitality programs
• Various social activities such as team outings, drinks, and events with colleagues

Important Details

• Schedule: hybrid, a combination of working from home and at the office

Application Process

1. Your application: Review of CV and vacancy questions, followed by an online assessment (aptitude test and personality questionnaire)
2. First interview: Meeting with a recruiter and a colleague from the relevant department
3. Follow-up interview: Deeper dive into the role and substantive topics, potentially including a business case; sometimes a final interview takes place
4. The offer: Receipt of an offer detailing salary and complete employment conditions
5. Screening: DISA conducts a screening, including reference checks, followed by an extensive onboarding program

About the Company

KPMG's Security Office (RM/SO), part of Risk Management, is responsible for developing information security policy, assessing its implementation within KPMG services, products, and internal processes, and advising Assurance, Advisory, and Central Services on its correct application. RM/SO conducts risk analyses to understand key risks and necessary measures to keep them within KPMG's risk appetite.