GRC and Vendor Risk Management

About the role

We are looking for an Information Security – GRC Engineer to support and drive Whatfix's multi-framework compliance program across Information Security, Data Privacy, AI Governance, and Third-Party Risk Management (TPRM).

What you'll do

• Conduct and coordinate third-party information security, privacy, compliance, and AI risk assessments
• Review vendor-provided evidence and artefacts, including security questionnaires, certifications, audit reports, policies, and other assurance documentation
• Identify, assess, document, and track risks associated with third-party relationships and follow up on mitigation and remediation actions
• Maintain accurate vendor inventories, assessment records, risk ratings, findings, exceptions, and reassessment schedules
• Manage and continuously monitor the vendor/TPRM management platform and related trackers to ensure records remain complete and up to date

What you need

• Risk management
• ISO 27001
• Compliance
• Data privacy
• Due diligence
• SOP writing
• Any graduate

Good to have

• KYC
• LLMs