Senior Third-Party Risk Leader - HIPAA, ISO & HITRUST

Baylor Miraca Genetics Laboratories LLC; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Baylor Genetics is seeking a Manager, Third Party Risk to lead and mature our enterprise Third-Party Risk Management (TPRM) program. You will own vendor lifecycle, risk scoring, and security/privacy assessments across upstream and downstream vendors, ensuring HIPAA/GDPR compliance and audit readiness.

Reporting to the Director of Information Security, you will drive User Access Review programs and BAAs/DPAs, collaborating with Privacy, Compliance, Legal, and Procurement.

Qualifications

• Bachelor’s degree in Cybersecurity, IT, Risk Management or equivalent.
• 6–8 years in information security, risk or compliance with vendor management programs.
• Hands-on audit experience with ISO 27001, ISO 27701, ISO 42001 and HITRUST.
• Experience with UAR programs and least-privilege access controls.
• Knowledge of HIPAA, GDPR and PHI security requirements.

Responsibilities

• Lead and mature the enterprise Third-Party Risk Management program across vendors.
• Own vendor intake, risk scoring, and security reviews (SOC 2, HITRUST, ISO).
• Establish onboarding, monitoring, reassessment, and documentation SOPs.
• Conduct vendor audits for high-risk upstream vendors with PHI/PII access.
• Develop quarterly User Access Review programs and ensure access controls.
• Enforce least-privilege and collect attestations for audit readiness.

Skills

Vendor risk management

HIPAA/GDPR knowledge

Audit coordination

ISO 27001

ISO 27701

ISO 42001

HITRUST

Least-privilege access

Education

Bachelor’s degree in Cybersecurity/IT/Risk Management

Tools

TrustArc

Job description

Baylor Genetics is seeking a Manager, Third Party Risk to lead and mature our enterprise Third-Party Risk Management (TPRM) program. You will own vendor lifecycle, risk scoring, and security/privacy assessments across upstream and downstream vendors, ensuring HIPAA/GDPR compliance and audit readiness.

Reporting to the Director of Information Security, you will drive User Access Review programs and BAAs/DPAs, collaborating with Privacy, Compliance, Legal, and Procurement.