Third Party Security Risk Management Sr Soecialist

About the Role

Legend Biotech is seeking a Third Party Security Risk Management, Sr. Specialist as part of the IT team based in Somerset, NJ.


Role Overview

The ideal candidate is experienced with information security industry Third Party Security Risk Management (TPSRM) best practices, modern automation and security tools. We are looking for someone with a security mindset who "thinks like an attacker". This position will support Legend’s TPSRM security and data privacy vendor assessment program. Drive continuous improvement of the process and facilitate tools to streamline TPSRM. Will collaborate with all business unit stakeholders globally to educate on the program and offer advice on security vendor risk mitigation as needed. Perform as a subject matter expert on TPSRM with responsibilities to review and assess vendors onboarding in Legend globally. Build strong relationships with key stakeholders; Legal, Compliance and Procurements units.


Key Responsibilities

Operate within Legend’s established TPSRM vendor assessment program, performing Third Party risk assessments using the security controls implemented by the company.
Execute vendor management processes to optimize relationships with vendors and deliver best results, aligned to business risk mitigation.
Manage scheduling and execution of assessments (cybersecurity, privacy, AI, security design questionnaire).
Evaluate key information security risks including confidentiality, integrity and availability of technology components through review of security operational processes, such as vulnerability management, security logging and monitoring, security incident response, and defense in depth strategies.
Define appropriate risk levels and corrective actions for issues identified. Formally communicate risks identified and remediation accepted by the business.
Ensure all third-party risk assessments, findings, recommendations, and remediation actions are thoroughly documented.
Engage in post assessment activities including validation of initial findings with management and business unit, follow-up on risk remediation’s and mitigation.
Maintain security risk register and reassess vendors on the defined TPSRM schedule.
Maintain and enhance KPI metrics. Provide periodic updates to management.
Serve as a subject matter expert to identify and address key third party related risks and areas of concern associated with new and existing third parties.
Enhance current TPSRM program to ensure risks are captured for all levels of vendors.
Collaborate and standardize TPSRM program with local teams globally.
Refine the light SIG for vendors that do not meet criteria for full assessment
Develop and deploy methods to better identify emerging risks associated with third party vendors
Maintain and enhance continuous assessment tool usage and continuous improvement initiatives (assessment/reassessment timeliness, risk remediation rate, reduction in residual risk).
Collaborate closely with the Procurement Team and business owners.
Provide supporting TPSRM documentation for assessment and audit.
Conduct kickoff meetings with vendors and Third-Party Managers to help identify and understand all technology involved in their service delivery and to also establish the scope of assessment
Reports on assessment outcomes to Business Owners, risk level and associated recommendations, and present issues to 3rd parties and obtain corrective action plans
Requests, reviews and validates artifacts in the form screenshots and other documentations to close out and audit item provided by vendors