TPRM Analyst

Marks and Spencer; Salford; Hybrid; GBP 45,000 - 65,000; Full time

Benefits offered by this job

20% colleague discount on M&S products

Competitive holiday allowance

Discretionary bonus schemes

Strong pension and life assurance

Induction and training

M&S Choices portal

Family policies

Wellbeing support

Volunteer day

Job summary

Marks & Spencer is seeking an experienced Third-Party Risk Management Analyst to ensure suppliers' security positions align with M&S standards and contractual terms. You will assess third-party security risk, act as the point of contact for suppliers, and monitor security posture throughout contracts.

You will work with a team of analysts, escalate identified issues, and provide guidance on risk mitigation.

Qualifications

• Demonstrable knowledge of third-party security and cybersecurity governance, including risk assessment, reporting, policies, processes and standards.
• Experience delivering and analysing third-party security risk assessments against organisational standards and supplier security obligations.
• At least 2 years' relevant security-related experience, ideally across sectors such as retail or financial services.
• Strong analytical, problem-solving and reporting skills, with the ability to present assessment outcomes to specialists and principals.
• Strong organisational and stakeholder-management skills, with the ability to meet deadlines and support improvements to processes, methods and tools.

Responsibilities

• Deliver third-party security risk assessments during vendor selection, onboarding and ongoing monitoring.
• Analyse assessment outputs to identify, advise on and escalation potential or actual security risks to M&S.
• Prepare and maintain reporting on third-party security risk posture, including KPIs and dashboards.
• Review cybersecurity contractual clauses and collaborate with Legal, Data Protection & Privacy and Procurement teams.
• Contribute to TPRM programme processes, standards and guardrails while engaging suppliers and internal security teams on incidents, insights and mitigations.

Skills

TPRM governance

Risk assessment

Reporting

Stakeholder mgmt

Cybersecurity

Tools

NIST/ISO 27001

Job description

All the details

Location

Salford Quays, Manchester or Waterside Office, London

Summary

We are seeking an experienced Third-Party Risk Management Analyst to ensure that our suppliers' security positions are in line with M&S standards and contractual terms. With oversight from the Third-Party Risk Management Leadership and Principal, you will be responsible for the analysis and assessment of third-party security risk assessments to identify potential security risks to M&S.

You will also act as a nominated single point contact for suppliers and will be responsible for assessing / monitoring their security posture throughout the lifecycle of M&S contracts. You will work alongside a team of analysts and take operational direction from TPRM specialists and risk management. You are expected to perform third party assessments based on structured responses to an M&S SIG based question framework whilst advising or escalating when you identify potential or actual security issues.

This role requires excellent communication skills, with the proven ability to provide security analysis and guidance to teams outside of the immediate security environment.

What you'll do

• Deliver third-party security risk assessments during vendor selection, onboarding and ongoing monitoring.
• Analyse assessment outputs to identify, advise on and escalation potential or actual security risks to M&S.
• Prepare and maintain reporting on third-party security risk posture, including KPIs and dashboards.
• Review cybersecurity contractual clauses and collaborate with Legal, Data Protection & Privacy and Procurement teams.
• Contribute to TPRM programme processes, standards and guardrails while engaging suppliers and internal security teams on incidents, insights and mitigations.

Who you are

• Demonstrable knowledge of third-party security and cybersecurity governance, including risk assessment, risk analysis, reporting, policies, processes and standards.
• Experience delivering and analysing third-party security risk assessments against organisational standards and supplier security obligations.
• At least 2 years' relevant security-related experience, ideally across sectors such as retail or financial services.
• Strong analytical, problem-solving and reporting skills, with the ability to present assessment outcomes to specialists and principals.
• Strong organisational and stakeholder-management skills, with the ability to meet deadlines and support improvements to processes, methods and tools.

What's in it for you?

Working at M&S means being part of something bigger - helping to deliver quality, value and service to millions of customers every day. We're inclusive, fast-moving and always evolving, with a strong sense of purpose and a focus on doing the right thing.

Here are just a few of the benefits that make working here even more rewarding:

• 20% colleague discount on all M&S products and many third-party brands for you and someone in your household, available once you've completed your probation

• Competitive holiday allowance with the option to buy more

• Discretionary bonus schemes linked to your performance and ours

• Strong pension and life assurance to help plan for the future

• Tailored induction and training to support your development from day one

• Exclusive perks and savings through our M&S Choices portal

• Market-leading family policies, including parental, adoption and neonatal leave

• 24/7 wellbeing support, including virtual GP access and mental health services

• One paid volunteer day a year to support a cause that matters to you

Everyone's welcome

We are ambitious about the future of retail. We're disrupting, innovating and leading the industry into a more conscientious, inspiring digital era. We're transforming how we work together and offering our most exciting opportunities yet. Marks & Spencer strives to be an inclusive organisation, trusted and admired by our colleagues, customers and suppliers. Join us and make change happen.

We are committed to building diverse and representative teams, where everyone can bring their whole selves to work and be at your best. We support each other and work together to win together.

If you feel you'd benefit from any support or reasonable adjustments during any stage of the recruitment process, please don't hesitate to let us know when completing your application. This information will be picked up by our team, so we can try and put steps in place to help you be at your best through this process.

#LI-hybrid #LI-CC1 #hybridrole