Sr Mgr Third Party Risk

Baylor Genetics; Northern (KY); On-site; USD 120,000 - 160,000; Full time

Job summary

Baylor Genetics seeks a Manager, Third Party Risk to build and mature our enterprise TPRM program. Reporting to the Director of Information Security, you will own vendor intake, risk tiering, security and privacy assessment, onboarding, ongoing monitoring, and offboarding for upstream and downstream vendors.

Lead the UAR program, drive audit readiness across ISO 27001, ISO 27701, ISO 42001, and HITRUST, and partner with Privacy, Compliance, and Legal to ensure BAAs/DPAs and DPIAs/TIAs are in

Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Risk Management, or an equivalent field.
• 6–8 years of experience in information security, risk, or compliance, including experience creating and running upstream and downstream vendor management programs.
• Hands-on audit experience with ISO 27001, ISO 27701, and ISO 42001.
• Demonstrated HITRUST experience (assessment, readiness, and/or certification support).
• Experience developing and managing recurring User Access Review (UAR) programs and least-privilege access controls.
• Working knowledge of vendor risk assessment methodologies (e.g., SIG) and risk scoring/tiering.
• Strong understanding of HIPAA, GDPR, and security requirements for PHI and sensitive PII.

Responsibilities

• Lead enterprise Third-Party Risk Management program across vendors.
• Own vendor intake, reassessment, inherent-risk scoring, risk-tier assignment, and lead security and cybersecurity reviews SOC 2, HITRUST, ISO 27001 for medium- and high-risk vendors.
• Establish onboarding, continuous monitoring, and reassessment process leveraging the SIG questionnaire, and draft SOPs and policies.
• Conduct internal and external vendor audits including high-risk upstream vendors with PHI/PII access; maintain vendor risk heat map.
• Operate ongoing monitoring (annual reassessment for high-risk, biennial for medium-risk); track remediation with cross-department coordination.
• Develop and manage the recurring User Access Review program across in-scope applications; cover employees, contractors, temporary staff, and vendors; extend to privileged accounts.
• Enforce least-privilege access and produce attestations for HIPAA, GDPR, and audit requirements.
• Drive audit readiness across ISO 27001, ISO 27701, ISO 42001, HITRUST with Privacy, Compliance, and Legal teams.
• Produce regular risk reports and KPIs for leadership on vendor posture and audit progress.

Skills

Vendor risk management

ISO 27001 experience

HITRUST experience

User Access Review (UAR)

HIPAA knowledge

GDPR knowledge

Education

Bachelor’s degree in Cybersecurity/IT/Risk Management

Tools

TrustArc

Job description

Job Category: Information Technology (IT)

Requisition Number: SRMGR002511

• Posted : September 9, 2026
• Full-Time
• Remote

Locations

Showing 1 location

Remote
United States

Description

JOB SUMMARY

Baylor Genetics is seeking a Manager, Third Party Risk to build, lead, and mature our enterprise Third-Party Risk Management (TPRM) program. As one of the nation’s leading clinical genetic testing laboratories, we entrust vendors and partners with highly sensitive data including Protected Health Information (PHI) and Sensitive Personal Information, this role ensures every third party that creates, receives, maintains, transmits, or accesses that data does so in compliance with HIPAA, GDPR, CLIA, CAPA, and other applicable regulatory requirements.

Reporting to the Director of Information Security, the Third Party Risk Manager owns the full vendor lifecycle intake, risk tiering, security and privacy assessment, onboarding, ongoing monitoring, and offboarding for both upstream and downstream vendors. This role also leads Baylor Genetics’ recurring User Access Review (UAR) program and drives audit readiness across ISO 27001, ISO 27701, ISO 42001, and HITRUST. Scope may evolve as organizational needs change.

Key Responsibilities

• Lead and continuously mature the enterprise Third-Party Risk Management program using a risk-based, lifecycle approach covering both upstream and downstream vendors.
• Own vendor intake and reassessment, inherent-risk scoring, risk-tier assignment, and lead security and cybersecurity reviews SOC 2, HITRUST, ISO 27001) for medium- and high-risk vendors.
• Establish a standardized vendor onboarding, continuous monitoring, and reassessment process leveraging the SIG questionnaire, and draft the SOPs, policies, and documentation that govern intake, assessment, and monitoring.
• Conduct internal and external vendor audits including "high-risk" upstream vendors with access to PHI, PII, and AI categorize vendors by criticality, and maintain a vendor risk heat map and single source of truth.
• Operate ongoing monitoring (annual reassessment for high-risk, biennial for medium-risk vendors), track remediation, and collaborate with cross departmental stakeholders to ensure BAAs/DPAs, DPIAs/TIAs, and sub-processor requirements are in place.
• Develop and manage the recurring (quarterly) User Access Review program across in-scope applications, including employees, contractors, temporary staff, and vendors, and extend coverage to administrator and privileged accounts.
• Enforce least-privilege access, collect attestations of completion, and produce evidence to support HIPAA, GDPR, IGTC, and other applicable audit requirements.
• Drive audit readiness and evidence collection across ISO 27001, ISO 27701, ISO 42001, and HITRUST, partnering with Privacy, Compliance, and Legal.
• Produce regular reports, KPIs, and risk metrics for leadership on vendor risk posture, remediation status, and audit progress.
• Partner cross-functionally with Security, Privacy, Compliance, Procurement, and application teams; where vendors deliver software, review application-security evidence including static code analysis (e.g., SonarQube/SAST) results.
• Contribute to a culture of integrity and service by putting the customer first, treating colleagues with respect, and conducting business with the highest standards of professionalism.
• Perform other job-related duties as assigned to support the team and business needs.

Qualifications

Required

• Bachelor’s degree in Cybersecurity, Information Technology, Risk Management, or a related field or an equivalent combination of education and experience.
• Minimum of 6–8 years of experience in information security, risk, or compliance, including demonstrated experience creating and running upstream and downstream vendor management programs.
• Hands-on audit experience with ISO 27001, ISO 27701, and ISO 42001.
• Demonstrated HITRUST experience (assessment, readiness, and/or certification support).
• Experience developing and managing recurring User Access Review (UAR) programs and least-privilege access controls.
• Working knowledge of vendor risk assessment methodologies (e.g., SIG) and risk scoring/tiering.
• Strong understanding of HIPAA, GDPR, and security requirements for PHI and sensitive PII.

Preferred

• Relevant certifications such as CTPRP, CISSP, CISM, CISA, CRISC, or ISO 27001 Lead Auditor/Implementer.
• Experience with GRC platforms (e.g., TrustArc,) and vendor risk tooling.
• Prior experience in a healthcare, clinical laboratory, or other regulated (HIPAA/PHI) environment.
• People- or program-management experience leading assessments and coordinating cross-functional stakeholders.

Competencies

• Strong analytical and risk-based judgment with meticulous attention to detail.
• Excellent written and verbal communication; able to convey complex risk to technical and executive audiences.
• Program- and project-management skills, managing multiple concurrent assessments and deadlines.
• Collaborative influence across Security, Privacy, Compliance, Procurement, and business units.

Physical Demands and Work Environment

• Remote with occasional travel to headquarters in Houston, Texas.
• Frequently required to sit and use hand and finger dexterity for prolonged periods.
• Occasional travel for meetings, vendor audits, or conferences.

EEO Statement

Baylor Genetics is proud to be an equal opportunity employer committed to fostering an inclusive and diverse workplace. We welcome and encourage applicants from all backgrounds to apply. We do not discriminate on the basis of race, color, religion, national origin, sex, sexual orientation, gender identity, age, veteran status, disability, genetic information, pregnancy, childbirth, or any other status protected by applicable federal, state, or local law. If you need an accommodation during the application process, please contact our Human Resources team.

Equal Opportunity Employer
This employer is required to notify all applicants of their rights pursuant to federal employment laws.For further information, please review the Know Your Rights notice from the Department of Labor.