Program Manager, Cybersecurity Risk Supply Chain

The Cybersecurity Supply Chain Risk Program Manager is responsible for driving the execution and continuous improvement of the enterprise Cybersecurity Supply Chain Risk Management Program across a global portfolio of operating companies and brands. This role serves as the operational driver for Supply Chain cybersecurity risk governance, coordinating and facilitating Supply Chain risk management activities across multiple business units, geographic regions, and technology organizations to ensure consistent identification, assessment, prioritization, treatment, and reporting of cybersecurity risks.

Working within global Cybersecurity Risk team, the Cybersecurity Supply Chain Risk Program Manager partners closely with Governance, Compliance, Global Cybersecurity Service domains, Information Technology, Privacy, Legal, Internal Audit, Sourcing, and business leadership to drive a consistent and scalable supply chain risk management program that aligns with the organization's cybersecurity strategy, enterprise cybersecurity risk framework, and business objectives.

This position requires strong program management, stakeholder engagement, analytical, and communication skills to coordinate complex, cross-functional initiatives across a global enterprise while enabling informed, risk-based decision making.

• Drive the day-to-day execution of the global Cybersecurity Supply Chain Risk Management Program and operational functions.
• Ensure the development and maintenance of the cybersecurity supply chain risk management framework, operating model, processes, procedures, and governance documentation.
• Coordinate enterprise cybersecurity supply chain risk assessment activities across brands, third-party providers, and business initiatives.
• Drive continuous improvement of the cybersecurity supply chain risk program through process optimization, automation, and governance maturity initiatives.

• Facilitate and coordinate maintenance of the Enterprise Cybersecurity Risk Register and IT Cybersecurity Risk Register to ensure risks are appropriately documented, assessed, prioritized, and treated.
• Coordinate the lifecycle of cybersecurity supply chain risks, including identification, analysis, acceptance, monitoring, and closure.
• Facilitate risk review meetings with business, technology, and cybersecurity stakeholders.
• Track risk acceptance decisions, due diligence and risk mitigation progress
• Monitor emerging cyber threats and technology risks that may impact enterprise risk exposure.

• Serve as the central coordinator for cybersecurity supply chain risk activities across multiple global brands and operating companies.
• Promote standardized supply chain risk assessment methodologies while accommodating a diverse set of vendor types and business-specific regulatory and operational requirements.
• Facilitate collaboration between corporate cybersecurity teams and brand-level IT organizations.
• Share risk trends, lessons learned, and leading practices across the enterprise.
• Support integration of acquired businesses into the enterprise cybersecurity risk management program.

• Support the development of executive dashboards, key risk indicators (KRIs), key performance indicators (KPIs), and operational metrics for cybersecurity risk.
• Assist with preparation of risk reports for executive leadership, cybersecurity governance committees, enterprise risk committees, and audit committees.
• Communicate risk in clear business terms to technical and non-technical stakeholders.

• Coordinate risk acceptance documentation.
• Support internal audits, external audits, customer assessments, and regulatory…