Remote job
Cyber Security TPRM
Job details
About this role
Role overview
Lead and improve a third-party risk management program within an IT security and governance, risk, and compliance function. You will assess vendor security, help ensure requirements are reflected in selection and contracts, and report on risk and compliance to senior leaders. The role also maintains the tools and workflows used to document and manage these assessments.
Responsibilities
- Manage vendor risk assessments from onboarding through periodic review and offboarding. - Evaluate vendor controls, identify gaps, and recommend remediation based on applicable standards and regulations. - Maintain TPRM policies, procedures, and workflows aligned with frameworks such as PCI, NIST, ISO 27001, and SOC 2. - Work with procurement, legal, and business teams to include security requirements in vendor selection and contracts. - Track and report risk measures, trends, service-level performance, and compliance status. - Maintain GRC platforms and support internal and external audits related to third-party risk.
Requirements
- At least five years of experience in IT cybersecurity, including third-party risk management in a security or GRC function. - A bachelor’s degree or equivalent in an IT-related field. - Knowledge of risk frameworks and requirements such as CCPA, HIPAA, PCI-DSS, and NIST. - Hands-on experience with GRC tools such as AuditBoard/Optro or Archer. - Strong analytical, communication, and stakeholder-management skills; able to work independently and collaboratively.
Nice to have
Certifications such as CTPRP, CISA, CISSP, or CRISC; experience building vendor-risk dashboards with SQL and Power BI or Tableau; workflow automation using Python, Power Automate, or REST APIs; or practical use of AI, language models, or OCR for document processing.
Benefits and work setup
The position may be on-site or remote and has typically less than 10% overnight travel. Benefits listed include health coverage, retirement savings with company match, an employee stock purchase plan, paid time off, and life and disability coverage. The role has no direct reports.