Senior Vendor & Contract Manager

Mbi Llc; Trenton (NJ); On-site; USD 140,000 - 200,000; Full time

Job summary

MBI LLC is seeking a Senior Vendor & Contract Manager to lead enterprise-wide vendor compliance, third-party governance, and IT audit readiness under the CIO. The role focuses on policy lifecycle, ITGC enforcement, and right-to-audit clauses across the technology ecosystem.

The ideal candidate has 8+ years in IT compliance and TPRM within large-scale enterprises, with deep experience in SOC 1/2, NIST/ISO controls, and executive-level risk reporting.

Qualifications

• 8+ years of IT compliance, third-party risk management (TPRM), and audit governance experience in large-scale enterprise environments.
• Authoring and operationalizing enterprise IT security, governance and regulatory policies.
• Experience evaluating SOC 1/SOC 2 Type II reports, ITGCs, and NIST/ISO control frameworks.
• Strong track record presenting risk metrics, compliance status, and audit readouts to executives.
• Knowledge of NIST (SP 800-53 / CSF) and ISO 27001 frameworks.
• TPRM & cloud/SaaS vendor qualification experience.
• Bachelor's degree minimum.

Responsibilities

• Lead Third-Party Risk Management (TPRM) and vendor compliance across cloud providers, software vendors, and system integrators.
• Oversee IT audit readiness, evaluating SOC 1/SOC 2 Type II reports, ISO certifications, and third-party attestations.
• Manage remediation lifecycles and root-cause analyses to close audit deficiencies.
• Author and update IT security, governance, privacy policies, standards, and SOPs to align with NIST, state, and federal mandates.
• Enforce ITGC, access governance, and data protection baselines across internal and vendor environments.
• Collaborate with Legal and Procurement to review exhibits, DP/Sharing agreements, SLAs, and right-to-audit clauses.
• Advise CIO on enterprise compliance posture with risk dashboards and mitigation strategies.

Skills

IT Compliance, ITGC & Audit Governance

Policy authoring & updates

Audit finding remediation

NIST/ISO controls knowledge

TPRM & cloud/SaaS qualification

SOC1/SOC2 attestation evaluation

Bachelor's degree minimum

Education

Bachelor's Degree

Job description

We are seeking a Senior Vendor & Contract Manager reporting directly to the Chief Information Officer (CIO) to lead enterprise-wide vendor compliance, third-party governance, IT audit readiness, and policy lifecycle management across our technology ecosystem.

Key Responsibilities:

- Lead Third-Party Risk Management (TPRM), establishing vendor vetting, risk scoring, and continuous compliance oversight across cloud providers, software vendors, and system integrators.

- Oversee IT audit readiness and execution, evaluating vendor SOC 1/SOC 2 Type II reports, ISO certifications, and independent third-party control attestations.

- Manage finding remediation lifecycles, driving technical root-cause analyses with IT teams and verifying artifact evidence to close internal and external audit deficiencies.

- Author, update, and maintain all public-facing and internal IT security, privacy, and technology governance policies, standards, and standard operating procedures (SOPs) to ensure continuous alignment with NIST, state, and federal mandates.

- Enforce IT General Controls (ITGC), access governance, and data protection baselines across internal platforms and external vendor environments.

- Collaborate with Legal and Procurement to review and enforce compliance exhibits, Data Processing/Sharing Agreements, SLAs, and right-to-audit clauses.

- Advise the CIO directly on enterprise compliance posture, delivering executive risk scorecards, audit tracking dashboards, and mitigation strategies.

Qualifications:

- 8+ years of IT compliance, third-party risk management (TPRM), and audit governance experience within large-scale enterprise environments.

- Proven track record authoring and operationalizing enterprise IT security, governance, and data compliance policies.

- Deep technical familiarity evaluating SOC 1/SOC 2 Type II reports, ITGCs, and NIST/ISO control frameworks.

- Strong background presenting risk metrics, compliance status, and audit readouts directly to executive leadership.

Fill the skill matrix below:

Skill

Amount

Candidate's No. of years of experience

IT Compliance, ITGC & Audit Governance in Enterprise Environments

Required

8

Authoring & Updating Enterprise IT Security, Governance & Regulatory Policies

Required

7

Audit Finding Remediation, Technical Root-cause Analysis & Action Plans

Required

7

Alignment with NIST (SP 800-53 / CSF) and ISO 27001 Security Frameworks

Required

7

Third-Party Risk Management (TPRM) & Cloud/SaaS Vendor Qualification

Highly desired

7

Evaluating SOC 1 / SOC 2 Type II Reports & Independent Security Attestations

Highly desired

7

Bachelor's Degree minimum

Required