TPRM Analyst: Third-Party Security & Risk Oversight

Marks & Spencer; Manchester; Hybrid; GBP 50,000 - 70,000; Full time

Job summary

Marks & Spencer is seeking an experienced Third-Party Risk Management Analyst to ensure suppliers' security aligns with M&S standards and contractual terms. You will assess third-party security risk assessments and act as a point of contact for suppliers throughout contract lifecycles.

You will collaborate with Legal, Data Protection & Privacy and Procurement teams to review contractual clauses and report on KPIs and threat postures, while delivering governance under TPRM leadership.

Qualifications

• Knowledge of third-party security and cybersecurity governance.
• Experience delivering third-party security risk assessments.
• Minimum 2 years' relevant security experience, retail/financial services preferred.
• Strong analytical, reporting and stakeholder-management skills.

Responsibilities

• Deliver third-party security risk assessments during vendor selection, onboarding and ongoing monitoring.
• Analyse assessment outputs to identify and elevate potential or actual security risks.
• Prepare and maintain reporting on third-party security posture, including KPIs and dashboards.
• Review cybersecurity contractual clauses with Legal, Data Protection & Privacy and Procurement teams.
• Contribute to TPRM programme processes, standards and guardrails while engaging suppliers and internal security teams on incidents, insights and mitigations.

Skills

Third-party security

Cybersecurity governance

Risk assessment

Risk analysis

Reporting

Stakeholder management

Job description

Marks & Spencer is seeking an experienced Third-Party Risk Management Analyst to ensure suppliers' security aligns with M&S standards and contractual terms. You will assess third-party security risk assessments and act as a point of contact for suppliers throughout contract lifecycles.

You will collaborate with Legal, Data Protection & Privacy and Procurement teams to review contractual clauses and report on KPIs and threat postures, while delivering governance under TPRM leadership.