Senior Manager, Third Party Risk Management

Responsibilities

• Own strategy, design, and continuous improvement of the Third-Party/Vendor Risk Management (TPRM) program
• Define and maintain TPRM policy, standards, procedures, and risk-tiering methodology
• Establish third-party risk appetite and tolerance thresholds with CISO and GRC leadership
• Embed risk gates within sourcing, onboarding, contracting, renewal, and offboarding
• Lead the full vendor risk lifecycle: intake, inherent-risk classification, due diligence, residual-risk determination
• Operationalize inherent-risk tiering to scope assessment depth and cadence
• Direct security, privacy, and resilience assessments using methodologies such as SIG/Shared Assessments
• Evaluate fourth-party/Nth-party dependencies, vendor concentration, and systemic risk
• Establish and lead risk reviews for third-party AI/GenAI tooling
• Coordinate third-party incident response with SOC/IR
• Manage the third-party risk register and findings inventory
• Develop a standardized library of contractual security requirements
• Define and report outcome-driven metrics and KRIs

• 8+ years in information security, IT risk, or GRC
• 4+ years focused on third-party/vendor risk management
• 2+ years of direct people leadership managing analysts or a risk team
• Strong working knowledge of NIST CSF 2.0, ISO 27001, SOC 2, PCI DSS
• Experience reviewing assurance artifacts (SOC 2 Type II, ISO certifications, penetration test reports)
• Hands‑on experience with TPRM/GRC platforms and continuous monitoring/security‑rating tools
• Experience partnering with Procurement and Legal on vendor contracting and security/privacy terms
  
  Bachelor’s degree in a related field or equivalent professional experience