Third Party Risk Manager

To build and lead an enterprise Third-Party Risk Management program, the full-time remote Third Party Risk Manager will manage vendor lifecycle processes, conduct risk assessments, and ensure compliance with regulatory requirements for sensitive data handling. Key responsibilities Lead and mature the Third-Party Risk Management program, including vendor intake, risk tiering, and ongoing monitoring Develop and manage the User Access Review program, ensuring compliance with access controls and audit requirements Produce reports and collaborate cross-functionally to maintain vendor risk posture and support audit readiness Required qualifications Bachelor's degree in Cybersecurity, Information Technology, Risk Management, or a related field 6-8 years of experience in information security, risk, or compliance, with a focus on vendor management programs Hands-on audit experience with ISO 27001, ISO 27701, and ISO 42001 Experience developing and managing User Access Review programs and least-privilege access controls Strong understanding of HIPAA, GDPR, and security requirements for PHI and sensitive PII