About CRISIL Limited:

CRISIL is a leading, agile and innovative global analytics company driven by its mission of making markets function better.It has delivered independent opinions, actionable insights, and efficient solutions to over 100,000 customers through businesses that operate from India, the US, the UK, Argentina, Colombia, Poland, China, Hong Kong and Singapore.It is majority owned by S&P; Integral Inc, a leading provider of transparent and independent ratings, benchmarks, analytics and data to the capital and commodity markets worldwide.

About the Role

We are seeking a TPRM professional to run the third-party risk lifecycle end to end as a single point of ownership with the skills of doing inherent risk tiering, due diligence, SME co-ordination, contract handover, documentation and ongoing monitoring. This is a broad, hands-on role. The postholder carries the analyst work, the PMO scheduling and reporting, and the sourcing-side risk support in one seat.

The aim is to lighten the load on infosec, business continuity and compliance SMEs and to cut turnaround delays are the biggest criticism of the current process.

Key Responsibilities

Risk assessment and due diligence





- Run inherent risk assessment and apply the five-tier model to set basic or enhanced due diligence.
- Complete vendor due diligence and control reviews against ISO 27001, NIST, SOC reports, CIS Controls and ISO 22301.
- Assess control design and operating effectiveness; document ratings, evidence and rationale.
- Own DD completion which drive cases to closure, not to a queue.

SME and PMO co-ordination

- Prepare complete, validated review packs for infosec, business continuity and compliance.
- Schedule and track SME reviews, report throughput and ageing, escalate before SLA breach.
- Apply reliance on existing assurance so SMEs review gaps, not full questionnaires.

Sourcing and contract

- Support sourcing managers through vendor risk assessment in Ivalua and Prolog; quality check their input.
- Hand outcomes into contract orchestration via ZIP so clauses reflect the assessment.

Data and reporting

- Validate third party and assessment data; clear data quality exceptions.
- Report cycle time, backlog, SLA adherence, findings and remediation ageing.

Ongoing monitoring

- Run periodic re-assessment by tier, certification refresh and continuous monitoring alerts.
- Support vendor performance review alongside the business.

📌 Operational Risk Analyst (Bogotá)
🏢 Crisil
📍 Bogotá