Remote TPRM Lead – Enterprise Risk & Resilience

Sungrow Na; Northern (KY); Hybrid; USD 140,000 - 180,000; Full time

Job summary

Sungrow North America is seeking a Third Party Risk Management Lead to establish and operate a scalable program for vendor, supplier, and third-party risk across the organization. The role requires cross-functional influence in a regulated infrastructure environment and strong execution capabilities.

Responsibilities include risk tiering, security assessments, contract risk Clauses, and ongoing monitoring. This position offers remote work with travel up to 10% as needed.

Qualifications

• 7–10+ years of experience in third-party risk management, GRC, or vendor risk programs.
• Proven experience building or leading a TPRM program in a regulated or enterprise environment.
• Strong understanding of vendor risk assessment methodologies and security frameworks (NIST, ISO 27001, SOC 2).
• Experience reviewing security documentation and third-party attestations (SOC 2, ISO).
• Working knowledge of business continuity and resilience concepts (BIA, BCDR).
• Ability to drive cross-functional alignment and accountability.

Responsibilities

• Build and operate the TPRM program lifecycle, including vendor intake, risk tiering, and ongoing monitoring.
• Define and enforce minimum security requirements for vendors and suppliers.
• Partner with legal and procurement to embed security and risk clauses into contracts.
• Lead third-party security reviews, including questionnaires, evidence validation, and SOC 2/ISO artifacts.
• Identify and communicate material risks and required mitigations; track remediation.
• Maintain visibility into fourth-party dependencies and align with NIST/ISO/SOC 2/NERC CIP where applicable.
• Support development of BIA across critical functions and contribute to BCDR plans.

Skills

Vendor risk assessment

GRC

Regulated environment

Cross-functional collaboration

Executive reporting

Program leadership

Tools

TPRM platforms/tools

Job description

Sungrow North America is seeking a Third Party Risk Management Lead to establish and operate a scalable program for vendor, supplier, and third-party risk across the organization. The role requires cross-functional influence in a regulated infrastructure environment and strong execution capabilities.

Responsibilities include risk tiering, security assessments, contract risk Clauses, and ongoing monitoring. This position offers remote work with travel up to 10% as needed.