Ideal Candidate

• Strong risk leader with the ability to distinguish between acceptable contractual deviations, temporary accommodations, material control weaknesses, and risks requiring formal escalation or acceptance.

• Proven operational leader capable of building structure, driving consistency, and managing a high-demand service with multiple stakeholders and competing priorities.

• Brings strong understanding of how information security requirements translate into contractual obligations and can evaluate legal language through a practical risk lens.

• Highly disciplined in governance, documentation, exception management, and maintaining defensible audit trails for risk decisions.

• Demonstrated ability to influence legal, procurement, business, security, and supplier stakeholders without direct authority.

• Pragmatic and commercially aware, balancing risk management objectives with business outcomes and supplier realities.

• Service-oriented leader committed to responsiveness, consistency, stakeholder experience, and operational excellence.

Success Measures

• Consistent application of enterprise risk tolerances and contractual security standards.

• Achievement of service-level commitments and stakeholder satisfaction objectives.

• Effective documentation, governance, and escalation of security control exceptions and contractual deviations.

• Reduction in unmanaged contractual security risk across supplier agreements.

• Operational maturity demonstrated through scalable processes, metrics, reporting, and continuous improvement.

• Development of a high-performing team capable of delivering consistent, risk-informed contracting outcomes.

Key Responsibilities

• Lead the Supplier Security Due Diligence & Monitoring Service and oversee day-to-day service delivery.

• Manage and develop a team responsible for supplier security contracting support and risk-based decision making.

• Review and interpret supplier security assessment outcomes and monitoring results to guide contractual negotiations.

• Provide guidance on acceptable contractual security positions, fallback language, compensating controls, and alternative risk mitigation approaches.

• Ensure consistent application of enterprise security requirements across supplier agreements.

• Oversee documentation and tracking of contractual exceptions, deviations, and risk accommodations.

• Escalate contractual positions that exceed established risk tolerances through appropriate governance and risk acceptance processes.

• Partner closely with Legal, Procurement, Cybersecurity, Enterprise Risk Management, and business stakeholders to resolve complex supplier issues.

• Establish and maintain operational metrics, service-level objectives, reporting, and quality management practices.

• Lead continuous improvement efforts designed to improve scalability, consistency, and stakeholder experience.

Required Qualifications

• 7+ years of experience in information security, technology risk, third-party risk management, supplier risk management, governance, contracting, procurement, or related disciplines.

• 3+ years of leadership experience managing teams, services, programs, or operational functions.

• Experience evaluating cybersecurity and technology risks and applying sound risk-based decision-making principles.

• Strong understanding of supplier risk management, security controls, and governance practices.

• Experience working across legal, procurement, business, security, and risk management functions.

• Excellent written, verbal, stakeholder management, and executive communication skills.

Preferred Qualifications

• Experience supporting supplier contract negotiations involving cybersecurity and privacy requirements.

• Knowledge of third-party risk management programs and supplier security assessment methodologies.

• Experience with cybersecurity frameworks and standards such as NIST Cybersecurity Framework, NIST 800-53, ISO 27001, CIS Controls, and SOC reporting.

• Experience with enterprise risk management, governance, and risk acceptance processes.

• Professional certifications such as CISSP, CISM, CRISC, ITIL, PMP, or related credentials.

• Experience building, scaling, or transforming operational services and governance functions.