Ralph Lauren IT Third-Party Risk Management (TPRM) Manager

BoF Careers; Nutley (NJ); On-site; USD 120,000 - 190,000; Full time

Job summary

Ralph Lauren Corporation seeks an experienced Third-Party Risk Management (TPRM) manager to lead and enhance its TPRM program across the vendor lifecycle. The role partners with Procurement, Legal, Privacy, Information Security, and Internal Audit to identify, assess, and mitigate third‑party risks while supporting enterprise risk objectives.

Responsibilities include driving program maturity, automation, KPI/KRIs, and executive reporting, with coaching of TPRM analysts or external consultants.

Qualifications

• Bachelor’s degree in Information Security, Cybersecurity, IT or related field.
• 7+ years in information security, IT risk, cybersecurity or third‑party risk.
• 3+ years leading TPRM programs or teams.

Responsibilities

• Lead and optimize the Third-Party Risk Management program day-to-day.
• Maintain TPRM policies, standards, procedures, and governance.
• Drive maturity, automation, and process optimization across the program.
• Establish TPRM KPIs, KRIs, SLAs, and reporting metrics.
• Present risks to senior leadership and governance committees.

Skills

Vendor risk assessment

Risk analysis

Stakeholder management

Executive reporting

GRC platforms

Education

Bachelor's degree in Information Security or related field

Tools

OneTrust

ServiceNow

Archer

ProcessUnity

AuditBoard

Job description

Company Description

Ralph Lauren Corporation (NYSE:RL) is a global leader in the design, marketing and distribution of premium lifestyle products in five categories: apparel, accessories, home, fragrances, and hospitality. For more than 50 years, Ralph Lauren's reputation and distinctive image have been consistently developed across an expanding number of products, brands and international markets. The Company's brand names, which include Ralph Lauren, Ralph Lauren Collection, Ralph Lauren Purple Label, Polo Ralph Lauren, Double RL, Lauren Ralph Lauren, Polo Ralph Lauren Children, Chaps, among others, constitute one of the world's most widely recognized families of consumer brands. At Ralph Lauren, we unite and inspire the communities within our company as well as those in which we serve by amplifying voices and perspectives to create a culture of belonging, ensuring inclusion, and fairness for all. We foster a culture of inclusion through: Talent, Education & Communication, Employee Groups and Celebration.

Company Description

Ralph Lauren Corporation (NYSE:RL) is a global leader in the design, marketing and distribution of premium lifestyle products in five categories: apparel, accessories, home, fragrances, and hospitality. For more than 50 years, Ralph Lauren's reputation and distinctive image have been consistently developed across an expanding number of products, brands and international markets. The Company's brand names, which include Ralph Lauren, Ralph Lauren Collection, Ralph Lauren Purple Label, Polo Ralph Lauren, Double RL, Lauren Ralph Lauren, Polo Ralph Lauren Children, Chaps, among others, constitute one of the world's most widely recognized families of consumer brands. At Ralph Lauren, we unite and inspire the communities within our company as well as those in which we serve by amplifying voices and perspectives to create a culture of belonging, ensuring inclusion, and fairness for all. We foster a culture of inclusion through: Talent, Education & Communication, Employee Groups and Celebration.

Position Overview

The Third-Party Risk Management (TPRM) manager is responsible for leading and enhancing Ralph Lauren's Third-Party Risk Management program. This role oversees the assessment, monitoring, and reporting of third-party risks across the vendor lifecycle, ensuring alignment with information security, privacy, compliance, regulatory, and business requirements. The successful candidate will partner with Procurement, Legal, Privacy, Information Security, Internal Audit, and business stakeholders to identify, assess, and mitigate risks associated with third-party providers while supporting enterprise risk management objectives. The role will also drive program maturity, operational efficiency, reporting, and continuous improvement initiatives.

Essential Duties & Responsibilities

• Manage day-to-day execution of the Third-Party Risk Management program.
• Maintain and enhance TPRM policies, standards, procedures, and governance frameworks.
• Drive program maturity improvements, automation initiatives, and process optimization.
• Establish and monitor TPRM KPIs, KRIs, SLAs, and reporting metrics. Risk Assessments & Due Diligence
• Lead risk assessments of new and existing third-party providers.
• Review SIG questionnaires, SOC reports, ISO certifications, penetration testing reports, and other security documentation.
• Evaluate information security, privacy, compliance, operational, and resilience risks.
• Document findings, develop risk assessments, and provide recommendations for remediation. Risk Governance & Oversight
• Facilitate risk acceptance, exception management, and escalation processes.
• Present significant third-party risks to senior leadership and governance committees.
• Ensure consistent application of risk-tiering methodologies and review requirements.
• Support audits, regulatory inquiries, and compliance initiatives. Stakeholder Management
• Serve as the primary point of contact for business stakeholders regarding third-party risk requirements.
• Partner with Procurement, Legal, Privacy, Architecture, Security Engineering, and business units throughout the vendor lifecycle.
• Provide guidance on security and compliance requirements during vendor onboarding and contract negotiations. Reporting & Analytics
• Develop executive-level dashboards and reporting related to vendor risk posture, assessment volumes, remediation status, SLA performance, and program health.
• Track and report findings, remediation progress, and emerging third-party risks.
• Provide actionable insights to leadership to support informed risk decisions. Team Leadership
• Manage and mentor TPRM analysts and/or external consultants.
• Establish quality standards for risk assessments and deliverables.
• Promote a culture of accountability, operational excellence, and continuous improvement.

Experience, Skills & Knowledge

Education

• Bachelor's degree in Information Security, Cybersecurity, Information Technology, Business Administration, Risk Management, or related field. Experience

Experience

• 7+ years of experience in Information Security, IT Risk Management, Cybersecurity, Compliance, Internal Audit, or Third-Party Risk Management.
• 3+ years of experience managing TPRM programs or teams.
• Experience evaluating security controls and industry standards such as ISO 27001, NIST, SOC 1, SOC 2, PCI DSS, and privacy regulations.

Skills

• Strong vendor risk assessment and risk analysis capabilities.
• Knowledge of cybersecurity, privacy, and regulatory requirements.
• Exceptional stakeholder management and communication skills.
• Strong reporting, metrics, and executive presentation skills.
• Experience with GRC and TPRM platforms (e.g., OneTrust, ServiceNow, Archer, ProcessUnity, AuditBoard).

Preferred Qualifications

• CISSP, CISM, CRISC, CISA, CGEIT, or equivalent certification.
• Experience in retail, consumer products, or global enterprise environments.
• Experience implementing TPRM automation and workflow solutions.
• Knowledge of privacy regulations and data protection frameworks.