Senior Third-Party Risk Lead (Remote)

Baylor Genetics; Northern (KY); Híbrido; USD 120.000 - 160.000; Jornada completa

Descripción de la vacante

Baylor Genetics seeks a Manager, Third Party Risk to build and mature our enterprise TPRM program. Reporting to the Director of Information Security, you will own vendor intake, risk tiering, security and privacy assessment, onboarding, ongoing monitoring, and offboarding for upstream and downstream vendors.

Lead the UAR program, drive audit readiness across ISO 27001, ISO 27701, ISO 42001, and HITRUST, and partner with Privacy, Compliance, and Legal to ensure BAAs/DPAs and DPIAs/TIAs are in

Formación

• Bachelor’s degree in Cybersecurity, Information Technology, Risk Management, or an equivalent field.
• 6–8 years of experience in information security, risk, or compliance, including experience creating and running upstream and downstream vendor management programs.
• Hands-on audit experience with ISO 27001, ISO 27701, and ISO 42001.
• Demonstrated HITRUST experience (assessment, readiness, and/or certification support).
• Experience developing and managing recurring User Access Review (UAR) programs and least-privilege access controls.
• Working knowledge of vendor risk assessment methodologies (e.g., SIG) and risk scoring/tiering.
• Strong understanding of HIPAA, GDPR, and security requirements for PHI and sensitive PII.

Responsabilidades

• Lead enterprise Third-Party Risk Management program across vendors.
• Own vendor intake, reassessment, inherent-risk scoring, risk-tier assignment, and lead security and cybersecurity reviews SOC 2, HITRUST, ISO 27001 for medium- and high-risk vendors.
• Establish onboarding, continuous monitoring, and reassessment process leveraging the SIG questionnaire, and draft SOPs and policies.
• Conduct internal and external vendor audits including high-risk upstream vendors with PHI/PII access; maintain vendor risk heat map.
• Operate ongoing monitoring (annual reassessment for high-risk, biennial for medium-risk); track remediation with cross-department coordination.
• Develop and manage the recurring User Access Review program across in-scope applications; cover employees, contractors, temporary staff, and vendors; extend to privileged accounts.
• Enforce least-privilege access and produce attestations for HIPAA, GDPR, and audit requirements.
• Drive audit readiness across ISO 27001, ISO 27701, ISO 42001, HITRUST with Privacy, Compliance, and Legal teams.
• Produce regular risk reports and KPIs for leadership on vendor posture and audit progress.

Conocimientos

Vendor risk management

ISO 27001 experience

HITRUST experience

User Access Review (UAR)

HIPAA knowledge

GDPR knowledge

Educación

Bachelor’s degree in Cybersecurity/IT/Risk Management

Herramientas

TrustArc

Descripción del empleo

Baylor Genetics seeks a Manager, Third Party Risk to build and mature our enterprise TPRM program. Reporting to the Director of Information Security, you will own vendor intake, risk tiering, security and privacy assessment, onboarding, ongoing monitoring, and offboarding for upstream and downstream vendors.

Lead the UAR program, drive audit readiness across ISO 27001, ISO 27701, ISO 42001, and HITRUST, and partner with Privacy, Compliance, and Legal to ensure BAAs/DPAs and DPIAs/TIAs are in