IS Third Party Risk Management

General Info

• Department: Information Security & Business Continuity Management – Information Security Third Party Risk Management
• Work time Percentage: 100%- 12 months temporary contract
• Location: Zurich

Our Company

EFG International is a global private banking group, offering private banking and asset management services. We serve clients in over 40 locations worldwide. EFG International offers a stimulating and dynamic work environment and strives to be an employer of choice. EFG is committed to providing an equitable and inclusive working environment that is founded on the principle of mutual respect. Joining our team means experiencing a supportive environment, where your contributions are valued and recognised. We strongly believe that the diversity of our teams gives us a competitive advantage by fostering better decision-making and greater innovation.

Our Purpose and Mission

Empowering entrepreneurial minds to create value – today and for the future. We are a private bank, offering personalised solutions on a global scale to private and institutional clients. Our sustainable success is based on our talents and on how we partner with our clients and communities to create lasting value.

Job Description

We are looking for a temporary (12 month contract) experienced Information Security Third Party Risk Management (TPRM) professional to lead the end‑to‑end TPRM lifecycle for EFG Group. In this Zurich‑based role, you will act as the primary process owner for our global TPRM framework and platform, covering onboarding, risk assessment, due diligence, ongoing monitoring and offboarding of third‑party providers and outsourced services.

Operating within the Information Security & Business Continuity function, you will work autonomously on complex, cross‑functional topics and provide expert challenge and guidance to Procurement, Legal, Compliance, Operational Risk, Business Owners and Business Continuity across multiple jurisdictions. Reporting to the TPRM Manager (under the Group Chief Information Security Officer), you will play a key role in shaping the Group’s medium‑term (1–5 year) third‑party risk posture and control environment, directly influencing decisions that affect operational continuity and regulatory compliance.

Key Responsibilities

• Lead the end‑to‑end onboarding process for new third parties and services in scope of TPRM, ensuring inherent risk assessment, due diligence and approvals are completed before contract signature or service go‑live.
• Design and apply robust inherent risk scoping for new and existing third‑party relationships, assessing data sensitivity, service criticality, outsourcing status, location and concentration risk to determine the required level of oversight.
• Direct and coordinate due diligence activities with key control functions (Information Security, Compliance, Legal, Operational Risk, Business Continuity, Procurement), ensuring all relevant risk domains are covered and issues are clearly documented, owned and tracked.
• Conduct and critically challenge third‑party risk assessments across information security, data protection, operational resilience, financial, compliance and ESG (where applicable), interpreting questionnaires, evidence and certifications using sound professional judgement.
• Evaluate the design and operating effectiveness of third‑party controls, identify gaps and issues, and agree risk‑based remediation actions, timelines and residual risk positions with internal stakeholders and, where appropriate, with the third party.
• Classify third parties into risk tiers and criticality levels based on defined criteria, ensuring that monitoring activities, review frequency and escalation thresholds are aligned with the assigned tier.
• Lead the implementation and maintenance of ongoing monitoring plans for in‑scope third parties, including periodic reassessments, recertifications (e.g. annual or trigger‑based reviews) and event‑driven reviews following incidents or material changes.
• Own the configuration and continuous improvement of the TPRM platform, including workflows, questionnaires, scoring models, data structures and user roles, to support efficient, consistent and data‑driven risk management.
• Design and deliver training, guidance and communication on TPRM processes, platform usage and good practices to Business Owners and control functions, strengthening risk awareness and consistent application of the framework across the Group.
• Act as a central point of contact and trusted advisor for Business Owners, Procurement, Legal, Information Security, Compliance and Business Continuity on TPRM matters, including review of contractual clauses (e.g. audit rights, data protection, subcontracting, exit and resilience) and influencing risk‑based decisions.

Requirements and Qualifications

Education

• Minimum:
  • High school diploma or equivalent, combined with substantial relevant professional experience in information security, risk management, technology, finance or business.
• Preferred:
  • University degree in Information Security, Computer Science, Engineering, Business, Finance or a related discipline.

Professional Certifications / Licences

• Preferred:
  • Relevant professional certifications in information security or risk management (for example in areas such as information security management, risk management or ISO 27001), where applicable to the jurisdiction.

Professional Experience

• At least 10 years of experience in information security, risk management, vendor/third‑party management or closely related fields, ideally in a global or multi‑jurisdictional environment.
• Proven, hands‑on experience in Third Party Risk Management, including outsourcing, critical services, data protection, information security and operational resilience in a regulated environment.
• Experience working in or with regulated financial services or similarly highly regulated sectors; banking experience is a strong advantage.
• Practical experience with a TPRM or vendor management platform, including configuration, workflow design, data structures and user support.
• Demonstrated analytical and critical‑thinking skills, with the ability to challenge information, form independent views and make clear, risk‑based recommendations on complex third‑party relationships.
• Strong organisational and coordination skills, with the ability to manage multiple third‑party assessments and stakeholder interactions simultaneously and to prioritise effectively under time pressure.

Technical / Functional Knowledge

• Deep knowledge of third‑party risk management frameworks, methodologies and regulatory expectations related to outsourcing, information security and operational resilience in financial services.
• Strong understanding of information security and data protection principles as they apply to third‑party arrangements, including confidentiality, integrity, availability, access management, incident management and data handling.
• Proficiency in using workflow tools, risk assessment platforms and data‑driven dashboards, with the ability to shape efficient processes and data structures within the TPRM platform.
• High level of comfort working with structured data, questionnaires and evidence repositories, with strong attention to detail and a commitment to data quality.

Languages

• Excellent written and verbal communication skills, with the ability to explain complex risk and security concepts in a clear, pragmatic and business‑oriented way to non‑specialist stakeholders.
• Required: Fluent English.
• Preferred: Any additional languages relevant to the role’s geographic scope are an advantage.

Our Values

• Accountability: Taking ownership for tasks and challenges, as well as seeking continuous improvement
• Hands-on: Being proactive to rapidly deliver high-quality results
• Passionate: Being committed and striving for excellence
• Solution-driven: Focusing on client outcomes and treating clients fairly with a risk-aware mindset
• Partnership-oriented: Promoting collaboration and teamwork. Working together with an entrepreneurial spirit.