Key Responsibilities: 1. 沟通机制建立与标准对齐 / Communication Mechanism Setup & Standard Alignment a) 与全球监控团队建立定期沟通机制（如周会/月报/联合评审），确保信息同步与协作顺畅 / Establish regular communication mechanisms with the global monitoring team (e.g., weekly meetings/monthly reports/joint reviews) to ensure information synchronization and smooth collaboration b) 对齐全球供应商风险管理的统一标准、评估框架及分级策略，确保本地执行与集团方针一致 / Align with global unified standards, assessment frameworks, and tiering strategies for supplier risk management, ensuring local execution is consistent with corporate guidelines 2. 在库供应商定期及事件驱动审查 / Regular & Event-Driven Review of Active Suppliers a) 按既定周期（如季度/半年度）对在库供应商进行系统性风险再评估 / Conduct systematic risk reassessments of active suppliers at defined intervals (e.g., quarterly/semi-annually) b) 当供应商发生重大变更（如股权变动、数据泄露、安全事件、监管处罚等）时，立即启动专项审查 / Initiate ad-hoc reviews immediately upon major supplier changes (e.g., equity changes, data breaches, security incidents, regulatory penalties, etc.) 3. 合同状态核实与到期预警机制建立 / Contract Status Verification & Expiry Alert Mechanism a) 核实在库供应商合同的当前状态（有效期、续约条款、终止条件等），确保合同信息准确无误 / Verify the current status of active supplier contracts (validity period, renewal terms, termination clauses, etc.) to ensure accuracy of contract information b) 建立合同到期预警机制，提前通知相关业务及采购团队，避免合同失效或服务中断风险 / Establish a contract expiry alert mechanism to proactively notify relevant business and procurement teams, preventing contract lapse or service disruption risks 4. 第三方信息安全证书及安全报告审核 / Third-Party Information Security Certificates & Reports Review a) 审核供应商提供的信息安全证书（如ISO 27001、SOC 2、等保等）的真实性、有效性与覆盖范围 / Review the authenticity, validity, and scope of information security certificates provided by suppliers (e.g., ISO 27001, SOC 2, MLPS, etc.) b) 审阅供应商定期提交的安全评估报告、渗透测试结果及漏洞修复承诺，判断其安全态势是否达标 / Evaluate periodic security assessment reports, penetration test results, and vulnerability remediation commitments to determine whether the supplier’s security posture meets requirements 5. 供应商风险清单维护与未解决风险追踪 / Supplier Risk Register Maintenance & Open Risk Tracking a) 维护并实时更新供应商风险清单（风险登记册），记录风险等级、影响范围、责任方及处置状态 / Maintain and continuously update the supplier risk register, documenting risk levels, impact scope, responsible parties, and disposition status b) 对未解决风险设定明确整改时限，定期追踪整改进展，直至风险关闭或接受，并向上级汇报风险趋势 / Set clear remediation deadlines for unresolved risks, regularly track progress until risk closure or acceptance, and report risk trends to management Skills and Attributes for Success 1. 本科及以上学历，供应链管理、信息安全、风险管理或相关专业优先 / Bachelor’s degree or above in Supply Chain Management, Information Security, Risk Management, or related fields preferred 2. 2年以上供应商管理、风险管理或信息安全管理相关经验 / 2+ years of experience in supplier management, risk management, or information security management 3. 熟悉ISO 27001、NIST、SOC 2等信息安全框架及评估标准 / Familiar with information security frameworks and assessment standards such as ISO 27001, NIST, and SOC 2 4. 具备良好的数据分析能力及合同审阅基础能力 / Proficient in data analysis and possess foundational contract review capabilities 5. 英语可作为工作语言（书面及会议沟通） / Fluent in English as a working language (both written and meeting communication) 6. 细致严谨，具备跨团队沟通与协调能力 / Detail-oriented, rigorous, with strong cross-team communication and coordination skills