TPRM Analyst — Third-Party Security Risk (Hybrid)

Marks and Spencer; Salford; Hybrid; GBP 45,000 - 65,000; Full time

Benefits offered by this job

20% colleague discount on M&S products

Competitive holiday allowance

Discretionary bonus schemes

Strong pension and life assurance

Induction and training

M&S Choices portal

Family policies

Wellbeing support

Volunteer day

Job summary

Marks & Spencer is seeking an experienced Third-Party Risk Management Analyst to ensure suppliers' security positions align with M&S standards and contractual terms. You will assess third-party security risk, act as the point of contact for suppliers, and monitor security posture throughout contracts.

You will work with a team of analysts, escalate identified issues, and provide guidance on risk mitigation.

Qualifications

• Demonstrable knowledge of third-party security and cybersecurity governance, including risk assessment, reporting, policies, processes and standards.
• Experience delivering and analysing third-party security risk assessments against organisational standards and supplier security obligations.
• At least 2 years' relevant security-related experience, ideally across sectors such as retail or financial services.
• Strong analytical, problem-solving and reporting skills, with the ability to present assessment outcomes to specialists and principals.
• Strong organisational and stakeholder-management skills, with the ability to meet deadlines and support improvements to processes, methods and tools.

Responsibilities

• Deliver third-party security risk assessments during vendor selection, onboarding and ongoing monitoring.
• Analyse assessment outputs to identify, advise on and escalation potential or actual security risks to M&S.
• Prepare and maintain reporting on third-party security risk posture, including KPIs and dashboards.
• Review cybersecurity contractual clauses and collaborate with Legal, Data Protection & Privacy and Procurement teams.
• Contribute to TPRM programme processes, standards and guardrails while engaging suppliers and internal security teams on incidents, insights and mitigations.

Skills

TPRM governance

Risk assessment

Reporting

Stakeholder mgmt

Cybersecurity

Tools

NIST/ISO 27001

Job description

Marks & Spencer is seeking an experienced Third-Party Risk Management Analyst to ensure suppliers' security positions align with M&S standards and contractual terms. You will assess third-party security risk, act as the point of contact for suppliers, and monitor security posture throughout contracts.

You will work with a team of analysts, escalate identified issues, and provide guidance on risk mitigation.