Njua Zita Ndum
Peter Kiewit Sons
WI
1
Language
1
Certification
6
years of professional experience
Results-oriented IT professional specializing in Third Party Risk Management and compliance. Expertise in evaluating vendor security controls, conducting risk assessments, and developing policies to mitigate third-party risks. Strong foundation in security awareness training and regulatory frameworks including NIST, ISO 27001, HIPAA, and PCI-DSS. Committed to enhancing security cultures and fostering collaboration between technical and non-technical stakeholders.
Work History
Third-Party Risk Analyst
2 Years 4 Months- Conducted vendor risk assessments for onboarding, periodic reviews, material changes, remediation follow-up, and offboarding to ensure compliance and mitigate potential risks.
- Perform inherent-risk reviews by evaluating data sensitivity, PII/PHI exposure, system access, business criticality, regulatory scope, and operational dependency.
- Tier vendors as low, moderate, high, or critical risk and determine the appropriate level of due diligence and ongoing monitoring.
- Review vendor evidence including SIG responses, SOC 1/SOC 2 reports, penetration-test reports, SSPs, policies, BCP/DR plans, and vulnerability reports.
- Assess controls across access management, IAM/PAM, MFA, encryption, logging, vulnerability management, incident response, privacy, and business continuity.
- Document findings, assign severity, maintain risk registers, track remediation plans, and validate closure evidence.
- Support exception and risk-acceptance processes by documenting residual risk, compensating controls, business impact, and approval requirements.
- Partner with Procurement, Legal, Privacy, IT, Security, business owners, auditors, and vendors to clarify risk and move assessments to completion.
- Maintained dashboards and reports to visualize vendor risk posture, assessment status, open findings, overdue remediation, KPIs/KRIs, and program health for informed decision-making.
Security Awareness & Policy Analyst
3 Years 2 Months- Drafted, reviewed, and maintained information security and privacy policies, procedures, SOPs, standards, and control narratives.
- Reviewed policies for purpose, scope, roles and responsibilities, management approval, review frequency, revision history, compliance language, and employee acknowledgment.
- Supported annual policy reviews by confirming owners, approval status, version history, required updates, and alignment with internal and regulatory requirements.
- Created security awareness materials, employee communications, practical guidance, and training content for technical and non-technical audiences.
- Supported user-awareness sessions, security drills, training completion tracking, employee acknowledgments, and awareness reporting.
- Worked with engineers, system owners, architects, and business stakeholders to develop SSPs, process flows, diagrams, and risk-assessment templates.
- Compared policies, procedures, SSPs, interviews, and evidence to identify control gaps, documentation gaps, and differences between process design and actual practice.
- Supported IAM and PAM control documentation, including privileged access reviews, access certifications, role-based access, least privilege, and access-risk reduction.
- Used RSA Archer to track compliance records, cybersecurity incidents, control evidence, audit requests, findings, remediation status, and supporting documentation.
- Supported incident-response exercises, root-cause analysis, lessons learned, monthly security posture reporting, and compliance activities for NIST, HIPAA, PCI DSS, SOC, and RMF.
- Improve TPRM workflows by standardizing questionnaires, evidence requests, review notes, templates, and GRC tracking processes.
Education
Bachelor of Arts - law and political Science
Technical Diplomat - IT Support
Skills
Third party risk management
Regulatory compliance expertise
Standard operating procedures
Vendor security Assessment
Vendor Risk Training
Policy development
POAM
Incident management
Compliance Documentation
RSA Archer
Process Unity
ServiceNow
Risk registers
Microsoft Excel
Risk mitigation
Risk assessment
Business Continuity Planning
Certification
CompTIA Security+
Languages
French
Timeline
Third-Party Risk Analyst
Peter Kiewit Sons
04.2024 - CurrentRead More
Security Awareness & Policy Analyst
EchoStar
01.2021 - 03.2024Read More
Milwaukee Area Technical College
Technical Diplomat from IT Support
Read More
University of Douala
Bachelor of Arts from law and political Science
Read More