Manager, Third-Party Risk Management (TPRM)

Role overview

Lead a global third-party risk management program that evaluates supplier security across cloud services, software, business process outsourcing, and other critical providers. This is a hands-on leadership role: you will make evidence-based risk decisions, manage a team, advise senior stakeholders during US business hours, and shape practical uses of AI and automation in vendor assessments and follow-up.

Responsibilities - Own the vendor risk lifecycle, from discovery and tiering through due diligence, onboarding, monitoring, remediation, and offboarding; maintain the inventory, standards, policies, and service levels. - Lead deep reviews of vendors integrated with sensitive systems, assessing architecture, data flows, access, and control evidence; use threat modeling to define practical security requirements. - Coordinate mitigation plans and contract terms with vendors and internal Legal, Privacy, Procurement, and system owners; verify fixes and document accepted residual risks. - Address supplier concentration, dependencies, resilience, recovery, and exit readiness; confirm data handling and access removal when relationships end. - Set a roadmap for AI and automation in the program, and pilot workflows for evidence gathering, reconciliation, assessment drafting, and follow-up with traceability and human review. - Hire, coach, and manage risk professionals; provide US-hours escalation coverage and report program performance and material risks to leadership and auditors.

Requirements - At least six years of progressive experience in technical third-party risk, security risk, or security engineering, including complex vendor reviews and ownership of a TPRM program. - Experience leading distributed teams and coordinating work across risk and compliance specialties. - Strong understanding of enterprise integrations, including identity federation, OAuth, provisioning, APIs, service accounts, cloud permissions, network boundaries, and data flows. - Ability to assess assurance evidence such as SOC 2 Type II reports, penetration tests, and relevant ISO 27001 or PCI DSS materials, checking scope and applicability. - Experience using or piloting AI-assisted workflows, with sound judgment about output evaluation, failure handling, and protection of sensitive information. - Ability to turn findings into testable requirements, verified remediation, clear risk decisions, and concise stakeholder reporting.

Nice to have Experience evaluating AI and agentic services, including model and data providers, tool permissions, retention, subprocessors, prompt injection, and data exposure risks. Familiarity with security automation and engineering partnerships would support the program roadmap.

Benefits and work setup The position is US-based, preferably in the Eastern or Central time zone, with working hours aligned to US business needs and clear handoffs to global colleagues. It reports to the global GRC lead and includes delegated leadership and escalation responsibilities.