Manager, Third-Party Risk Management (TPRM)

doordashusa; United States; Remote; USD 180,000 - 240,000; Full time

Job summary

DoorDash is seeking a hands-on leader to run a global third-party risk management program. You will decide on risk posture, steer a team, and advise senior stakeholders during US business hours while shaping AI-assisted vendor assessments.

Responsibilities include end-to-end vendor risk lifecycle management, threat modeling for critical providers, and coordinating with Legal, Privacy, Procurement and system owners to ensure proper remediation and traceability.

Qualifications

• Six+ years leading third-party risk or security programs.
• Experience guiding risk decisions and team leadership.
• Familiarity with SOC 2, ISO27001, PCI DSS materials.

Responsibilities

• Own the vendor risk lifecycle from discovery to offboarding.
• Lead reviews of vendors with sensitive systems and model threats.
• Coordinate mitigation with Legal, Privacy, Procurement and owners.
• Address concentration, resilience, and data handling at offboarding.
• Roadmap AI/automation for evidence gathering and remediation.
• Hire and coach risk professionals; provide US-hours escalation.

Skills

Vendor risk management

Security risk

Team leadership

AI and automation in risk

Stakeholder communication

Job description

Role overview

Lead a global third-party risk management program that evaluates supplier security across cloud services, software, business process outsourcing, and other critical providers. This is a hands-on leadership role: you will make evidence-based risk decisions, manage a team, advise senior stakeholders during US business hours, and shape practical uses of AI and automation in vendor assessments and follow-up.

Responsibilities

• Own the vendor risk lifecycle, from discovery and tiering through due diligence, onboarding, monitoring, remediation, and offboarding; maintain the inventory, standards, policies, and service levels.
• Lead deep reviews of vendors integrated with sensitive systems, assessing architecture, data flows, access, and control evidence; use threat modeling to define practical security requirements.
• Coordinate mitigation plans and contract terms with vendors and internal Legal, Privacy, Procurement, and system owners; verify fixes and document accepted residual risks.
• Address supplier concentration, dependencies, resilience, recovery, and exit readiness; confirm data handling and access removal when relationships end.
• Set a roadmap for AI and automation in the program, and pilot workflows for evidence gathering, reconciliation, assessment drafting, and follow-up with traceability and human review.
• Hire, coach, and manage risk professionals; provide US-hours escalation coverage and report program performance and material risks to leadership and auditors.

Requirements

• At least six years of progressive experience in technical third-party risk, security risk, or security engineering, including complex vendor reviews and ownership of a TPRM program.
• Experience leading distributed teams and coordinating work across risk and compliance specialties.
• Strong understanding of enterprise integrations, including identity federation, OAuth, provisioning, APIs, service accounts, cloud permissions, network boundaries, and data flows.
• Ability to assess assurance evidence such as SOC 2 Type II reports, penetration tests, and relevant ISO 27001 or PCI DSS materials, checking scope and applicability.
• Experience using or piloting AI-assisted workflows, with sound judgment about output evaluation, failure handling, and protection of sensitive information.
• Ability to turn findings into testable requirements, verified remediation, clear risk decisions, and concise stakeholder reporting.

Nice to have

• Experience evaluating AI and agentic services, including model and data providers, tool permissions, retention, subprocessors, prompt injection, and data exposure risks. Familiarity with security automation and engineering partnerships would support the program roadmap.

Benefits and work setup

The position is US-based, preferably in the Eastern or Central time zone, with working hours aligned to US business needs and clear handoffs to global colleagues. It reports to the global GRC lead and includes delegated leadership and escalation responsibilities.