# Vendor Cyber Risk Management

**Company**: S&P Global
**Location**: Bengaluru, Karnataka
**Experience**: senior
**Job type**: full-time
**Category**: Security
**Industry**: Finance

**Apply**: https://spgi.wd5.myworkdayjobs.com/en-US/SPGI_Careers/job/Bengaluru-Karnataka/Analyst-II--Information-Security_332165-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_a9ce2a56-5e8

## Description

This role helps reduce the cyber risk posed by third parties and protects S&P Global brands against possible attacks against our information assets by threat actors via backdoor created by our vendors.

Primary responsibilities will include assessing Cybersecurity, Business Continuity controls for S&P third parties by conducting control risk assessments, risk recertifications, and continuously monitoring the vendors engaged by S&P.

**Responsibilities and Impact:** Working in Vendor Risk Management offers the opportunity to continuously enhance processes to meet the evolving requirements of various regulators.

**Key Responsibilities:**

- Conduct thorough Cybersecurity, Business Continuity, Artificial Intelligence assessments for various vendors such as Cloud Service Provider evaluating their information security policies, procedures, and controls.

- Effectively collaborate with internal teams to identify critical vendors and assess their potential impact on the organization's cyber risk profile.

- Communicate risk assessment findings and recommendations to key stakeholders, including senior management, legal, and compliance teams.

- Work closely with vendors to address identified security gaps and ensure they meet the organization's cybersecurity requirements.

- Review the vendors on the continuous monitoring program utilizing various attack surface monitoring tools and assisting in driving the periodical review of the vendors.

- Monitor and stay abreast of evolving cybersecurity threats and industry trends to enhance the effectiveness of the risk assessment process.

- Review the cyber security contracts for various clauses to cover for data Confidentiality, Integrity and Availability.

- Lead and support enhancement and strategic projects aligning with business objectives within Vendor Risk Management to meet various business and regulatory requirements.

- Assist the team members in balancing the load and managing Ad-hoc projects.

- Where required, lead the team for BAU (Business as Usual) tasks mentioned above.

**What We're Looking For:**

- Master/bachelor’s degree in computer science or engineering or equivalent

- 6+ years of experience in Information Security or Technology Risk Management

- Any prior exposure to Cyber vendor risk management and/ or privacy laws and regulations is a plus.

- Demonstrable understanding of the concepts of technology controls and information security controls.

- Exposure to cloud technologies and cloud security is highly desired; the familiarity with public cloud technologies such as Amazon Web Services (AWS) or Microsoft Azure or Google Cloud is highly preferred.

- Exposure to Attack Surface Monitoring tools is a plus.

- Exposure to vendor cyber security contracts is highly desired.

- Excellent communication skills - a must.

**Benefits:**

- Health & Wellness: Health care coverage designed for the mind and body.

- Flexible Downtime: Generous time off helps keep you energized for your time on.

- Continuous Learning: Access a wealth of resources to grow your career and learn valuable new skills.

- Invest in Your Future: Secure your financial future through competitive pay, retirement planning, a continuing education program with a company-matched student loan contribution, and financial wellness programs.

- Family Friendly Perks: It’s not just about you. S&P Global has perks for your partners and little ones, too, with some best-in class benefits for families.

## Skills

### Required
- Information Security
- Technology Risk Management
- Cyber vendor risk management
- Cloud Security
- Attack Surface Monitoring

### Nice to have
- Cloud technologies
- vendor cyber security contracts
- Information Security/Risk Management certification

---

Source: [Apply at spgi.wd5.myworkdayjobs.com](https://spgi.wd5.myworkdayjobs.com/en-US/SPGI_Careers/job/Bengaluru-Karnataka/Analyst-II--Information-Security_332165-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)