Strategic Third-Party Risk & Security Analyst

MARKS&SPENCER; Salford; Hybrid; GBP 35,000 - 52,000; Full time

Benefits offered by this job

20% colleague discount

Holiday allowance

Discretionary bonus schemes

Strong pension and life assurance

Tailored induction and training

MS Choices portal perks

Family policies (parental/adoption)

Job summary

Marks & Spencer is seeking an experienced Third-Party Risk Management Analyst to ensure suppliers’ security positions align with M&S standards and contractual terms. You will assess third-party security risk assessments and act as a single point of contact for suppliers throughout contract lifecycles.

You will provide security guidance, analyze outputs, and escalate issues as needed. Excellent communication is essential to advise teams outside security and to support risk management improvements.

Qualifications

• Demonstrable knowledge of third-party security and cybersecurity governance, including risk assessment, reporting, policies, processes and standards.
• Experience delivering and analysing third-party security risk assessments against organisational standards and supplier security obligations.
• At least 2 years' relevant security-related experience, ideally across sectors such as retail or financial services.
• Strong analytical, problem-solving and reporting skills, with the ability to present assessment outcomes to specialists and principals.
• Strong organisational and stakeholder-management skills, with the ability to meet deadlines and support improvements to processes, methods and tools.

Responsibilities

• Deliver third-party security risk assessments during vendor selection, onboarding and ongoing monitoring.
• Analyse assessment outputs to identify, advise on and escalation potential or actual security risks to M&S.
• Prepare and maintain reporting on third-party security risk posture, including KPIs and dashboards.
• Review cybersecurity contractual clauses and collaborate with Legal, Data Protection & Privacy and Procurement teams.
• Contribute to TPRM programme processes, standards and guardrails while engaging suppliers and internal security teams on incidents, insights and mitigations.

Skills

Third-party security governance

Risk assessment

Reporting & dashboards

Policies & standards

Stakeholder management

Data protection

Job description

Marks & Spencer is seeking an experienced Third-Party Risk Management Analyst to ensure suppliers’ security positions align with M&S standards and contractual terms. You will assess third-party security risk assessments and act as a single point of contact for suppliers throughout contract lifecycles.

You will provide security guidance, analyze outputs, and escalate issues as needed. Excellent communication is essential to advise teams outside security and to support risk management improvements.