Senior TPRM Analyst

About the position

We are looking for a Senior TPRM Analyst to assess, manage, and monitor risks associated with third parties, with a focus on critical and strategic suppliers. This professional will be responsible for conducting risk assessments, analyzing questionnaires and evidence of controls, identifying security and compliance gaps, and tracking action plans to completion.

The position requires analytical capability, critical thinking, organization, and the ability to interact with suppliers and internal teams, ensuring that identified risks are properly assessed, documented, addressed, and reported.

Key responsibilities

• Third-party risk management: perform TPRM assessments for critical, strategic, and high-risk suppliers, considering business impact, information security, and operational continuity.
• Questionnaire analysis: review and evaluate security, privacy, compliance, and risk management assessment forms completed by suppliers.
• Evidence validation: analyze documents and evidence provided by suppliers, verifying their consistency, validity, alignment with required controls, and sufficiency to support the responses provided.
• Gap identification: identify weaknesses, nonconformities, missing controls, inconsistencies, and risks associated with supplier processes and environments.
• Pending item tracking: manage and track pending items, requests for additional evidence, and action plans to address identified risks.
• Action plan validation: evaluate the adequacy of corrective actions proposed by suppliers, monitor deadlines, and validate evidence of control implementation before closing pending items.
• Continuous monitoring: monitor the status of critical suppliers, including periodic reassessments, material changes in risk profile, incidents, and changes that may impact security or service continuity.
• Criticality management: support the classification and prioritization of suppliers considering access to data, sensitive information, corporate systems, critical services, and potential business impact.
• Reporting and metrics: prepare tracking reports, dashboards, and risk metrics, including assessments in progress, pending items, delays, critical gaps, and action plan progress.
• Stakeholder interaction: work with Information Security, GRC, Privacy, Compliance, Legal, Procurement, contract managers, and supplier owners.
• Documentation and traceability: keep records of assessments, evidence, identified risks, decisions, owners, deadlines, and approvals properly updated.
• Risk escalation: communicate critical risks, significant delays, and situations with insufficient evidence to responsible teams, supporting decision-making and the formal acceptance of residual risk when applicable.
• Continuous improvement: contribute to improving methodologies, assessment criteria, workflows, controls, and third-party risk management processes.

Required qualifications

• Prior experience in TPRM, Third-Party Risk Management, Third-Party Risk Assessment, or supplier risk assessment.
• Knowledge of Information Security, GRC, cyber risk management, and control assessment.
• Experience analyzing security questionnaires and validating documentary evidence.
• Experience identifying gaps, recording risks, and tracking action plans.
• Knowledge of controls related to access management, data protection, vulnerability management, incident response, business continuity, and cloud security.
• Ability to critically analyze received information, identify inconsistencies, and request additional information when necessary.
• Experience preparing management reports, metrics, and risk assessment documentation.
• Strong written and verbal communication, organization, autonomy, and ability to manage multiple assessments simultaneously.

Desired knowledge

• Familiarity with ISO 27001 and ISO 27002.
• Knowledge of ISO 27701, LGPD, NIST Cybersecurity Framework, and CIS Controls.
• Knowledge of business continuity, incident management, and vulnerability management.
• Experience with GRC tools, TPRM platforms, assessment workflows, and action plan management.
• Knowledge of enterprise risk management frameworks and practices.
• Certifications such as ISO 27001, CRISC, CISA, CISM, or equivalent will be considered a plus.

Behavioral competencies

• Analytical, investigative, and risk-oriented profile.
• Critical thinking to question responses and evaluate the quality of evidence.
• Organization and discipline to track deadlines and pending items.
• Proactivity and autonomy in conducting assessments.
• Assertive communication to interact with suppliers and internal teams.
• Ability to prioritize based on criticality and business impact.
• Collaborative attitude, focused on quality, compliance, and risk mitigation.

Expected results

• Supplier assessments conducted with quality, consistency, and within established deadlines.
• Evidence analyzed and validated with traceability and technical justification.
• Gaps and risks identified, classified, and properly documented.
• Pending items and action plans tracked until validation of completion or formal escalation of residual risk.
• Greater visibility into risk exposure of critical suppliers.
• Updated metrics to support management, prioritization, and decision-making.

Position differentiator

We are looking for a professional who goes beyond documentary review, with the ability to understand the supplier context, evaluate the effectiveness of the controls presented, and contribute to a more efficient, structured, and business-aligned third-party risk management approach.

Work model and location

The role is hybrid, based in São Paulo, SP, combining in-office days with remote work.