TPRM Analyst: Vendor Security & Risk Strategist

Marks and Spencer plc (UK); Salford; On-site; GBP 42,000 - 56,000; Full time

Benefits offered by this job

20% discount

Holiday allowance

Bonus scheme

Pension & life assurance

Induction & training

M&S Choices portal

Family policies

Wellbeing support

Volunteer day

Job summary

Marks & Spencer plc in the United Kingdom seeks an experienced Third-Party Risk Management Analyst to ensure suppliers' security positions align with M&S standards. You will analyze third-party security risk assessments, monitor ongoing posture, and act as the point of contact for suppliers throughout contract lifecycles.

You will work with a team to deliver risk assessments, report KPIs and dashboards, and engage Legal, Data Protection & Privacy, and Procurement to address gaps.

Qualifications

• At least 2 years' relevant security-related experience.
• Experience delivering and analysing third-party security risk assessments.
• Strong analytical, problem-solving and reporting skills.
• Strong organisational and stakeholder-management skills.

Responsibilities

• Deliver third-party security risk assessments during vendor selection, onboarding and ongoing monitoring.
• Analyse assessment outputs to identify and advise on security risks to M&S.
• Prepare and maintain reporting on third-party security risk posture, including KPIs and dashboards.
• Review cybersecurity contractual clauses and collaborate with Legal, Data Protection & Privacy and Procurement teams.
• Contribute to TPRM programme processes, standards and guardrails while engaging suppliers and internal security teams on incidents, insights and mitigations.

Skills

Third-party risk management

Security risk assessment

Stakeholder management

Reporting & analytics

Vendor onboarding

Tools

SIG-based questionnaire

Job description

Marks & Spencer plc in the United Kingdom seeks an experienced Third-Party Risk Management Analyst to ensure suppliers' security positions align with M&S standards. You will analyze third-party security risk assessments, monitor ongoing posture, and act as the point of contact for suppliers throughout contract lifecycles.

You will work with a team to deliver risk assessments, report KPIs and dashboards, and engage Legal, Data Protection & Privacy, and Procurement to address gaps.