Hybrid TPRM Analyst: Third-Party Security & Risk

Marks & Spencer Plc; Salford; On-site; GBP 45,000 - 65,000; Full time

Benefits offered by this job

Colleague discount

Holiday allowance

Discretionary bonus

Pension

Training and development

Employee portal perks

Family policies

Wellbeing support

Volunteer day

Job summary

Marks & Spencer Plc is seeking an experienced Third-Party Risk Management Analyst to ensure suppliers' security positions align with M&S standards and contractual terms. You will assess third-party security risk assessments and act as a single point of contact for suppliers.

You'll work with a team of analysts under TPRM leadership to monitor security posture across the lifecycle of contracts, using structured responses to M&S SIG questions, and provide guidance to teams while escalating issues

Qualifications

• Demonstrable knowledge of third-party security and cybersecurity governance, including risk assessment, risk analysis, reporting, policies, processes and standards.

Responsibilities

• Deliver third-party security risk assessments during vendor selection, onboarding and ongoing monitoring.
• Analyse assessment outputs to identify, advise on and escalate potential or actual security risks to M&S.
• Prepare and maintain reporting on third-party security risk posture, including KPIs and dashboards.
• Review cybersecurity contractual clauses and collaborate with Legal, Data Protection & Privacy and Procurement teams.
• Contribute to TPRM programme processes, standards and guardrails while engaging suppliers and internal security teams on incidents, insights and mitigations.

Skills

Third-party risk

Cybersecurity governance

Risk assessment

Reporting

Stakeholder management

Job description

Marks & Spencer Plc is seeking an experienced Third-Party Risk Management Analyst to ensure suppliers' security positions align with M&S standards and contractual terms. You will assess third-party security risk assessments and act as a single point of contact for suppliers.

You'll work with a team of analysts under TPRM leadership to monitor security posture across the lifecycle of contracts, using structured responses to M&S SIG questions, and provide guidance to teams while escalating issues