IT Third-Party Risk Management (TPRM) Manager

Summary

The Third-Party Risk Management Manager leads and enhances the company's third-party risk program. The role oversees vendor risk assessments, monitoring, reporting, and program improvement in partnership with business and control functions.

Responsibilities

• Manage daily execution and governance of the TPRM program, including policies, procedures, metrics, and process improvements.
• Lead vendor risk assessments and review security documentation, identifying risks and recommending remediation.
• Coordinate risk acceptance, escalations, audits, and regulatory inquiries with internal stakeholders.
• Develop executive dashboards and reporting on vendor risk, remediation, and program performance.
• Manage and mentor analysts or consultants and maintain quality standards for assessments.

Requirements

• Bachelor's degree in information security, cybersecurity, information technology, business administration, risk management, or a related field.
• 7+ years of experience in information security, IT risk management, cybersecurity, compliance, internal audit, or third-party risk management.
• 3+ years of experience managing TPRM programs or teams.
• Experience evaluating security controls and standards such as ISO 27001, NIST, SOC 1, SOC 2, PCI DSS, and privacy regulations.
• Strong vendor risk analysis, stakeholder communication, reporting, and executive presentation skills.
• Experience with GRC or TPRM platforms; relevant professional certifications are preferred.