GRC and Vendor Risk Management Engineer

Role Summary:

We are looking for an Information Security – GRC Engineer to support and drive Whatfix's multi-framework compliance program across Information Security, Data Privacy, AI Governance, and Third-Party Risk Management (TPRM).

A key responsibility of this role will be to manage and operate the organization's end-to-end TPRM program, including vendor onboarding, risk assessments, due diligence, periodic reassessments, risk tracking, remediation, offboarding, and continuous improvement of the TPRM framework.

Roles & Responsibilities:

Over all 3+ years of experience in Third Party Risk Management

• Manage and operate the end-to-end Third-Party Risk Management (TPRM) program, including vendor onboarding, risk classification, due diligence, security and privacy assessments, periodic reassessments, remediation tracking, and offboarding.
• Conduct and coordinate third-party information security, privacy, compliance, and AI risk assessments.
• Review vendor-provided evidence and artefacts, including security questionnaires, certifications, audit reports, policies, and other assurance documentation.
• Identify, assess, document, and track risks associated with third-party relationships and follow up on mitigation and remediation actions.
• Maintain accurate vendor inventories, assessment records, risk ratings, findings, exceptions, and reassessment schedules.
• Manage and continuously monitor the vendor/TPRM management platform and related trackers to ensure records remain complete and up to date.
• Coordinate with internal stakeholders and vendors throughout the third-party lifecycle.
• Maintain and continuously improve TPRM policies, procedures, SOPs, risk assessment methodologies, and reporting.

GRC, Compliance & AI Governance

• Support the implementation, maintenance, and continual improvement of compliance programs, including (but not limited to) ISO 27001, ISO 27701, ISO 42001, CSA STAR, TISAX, Cyber Essentials Plus, GDPR, DPDP, HIPAA, and other applicable requirements.
• Manage day-to-day compliance activities, including GRC platforms, evidence collection, compliance trackers, stakeholder follow-ups, and SOPs.
• Support internal and external audits, including audit preparation, evidence management, stakeholder coordination, and tracking observations and corrective actions.
• Assist in conducting information security, privacy, compliance, and AI risk and impact assessments.
• Support the organization's AI governance program, including maintaining the AI inventory and supporting AI risk assessments and governance activities.
• Support periodic review and maintenance of Information Security, Privacy, AI, and other GRC-related policies and procedures.
• Assist with security, privacy, and AI awareness initiatives.
• Monitor relevant regulatory, security, privacy, and AI developments and support continuous improvement of GRC processes.
• Manage and coordinate customer due-diligence requests, including security, privacy, compliance, and AI questionnaires, evidence requests, and stakeholder coordination.
• Review information security, data privacy, and AI-related contractual requirements in customer and vendor agreements, including DPAs, security addendum, and other contractual obligations.

Functional Competencies:

• Strong understanding of Third-Party Risk Management, including vendor lifecycle management, due diligence, risk assessments, evidence review, risk rating, remediation, and periodic reassessments.
• Working knowledge of Information Security GRC, risk management, audits, and compliance management.
• Familiarity with relevant standards and regulations, including ISO 27001, ISO 27701, ISO 42001, CSA STAR, TISAX, Cyber Essentials Plus, GDPR, DPDP, and HIPAA.
• Understanding of AI governance, responsible AI, and AI risk/impact assessments.
• Strong analytical, documentation, stakeholder management, communication, and follow-up skills.
• Ability to manage multiple vendors, stakeholders, compliance activities, and deadlines with strong attention to detail.