TPRM Program Lead — IT Risk & Vendor Security

Ralph Lauren; Nutley (NJ); On-site; USD 140,000 - 190,000; Full time

Job summary

Ralph Lauren seeks a Third-Party Risk Management (TPRM) Manager to lead the program across the vendor lifecycle, aligning information security, privacy, compliance, and business needs. Partner with Procurement, Legal, Privacy, and IT Security to identify, assess, and mitigate third-party risks while driving program maturity and reporting.

The role requires executive communication, strong risk judgment, and experience with TPRM platforms.

Qualifications

• Bachelor's degree in Information Security, Cybersecurity, IT, Business Admin, Risk Management, or related field.
• 7+ years in Information Security, IT Risk Management, Cybersecurity, Compliance, Internal Audit, or TPRM.
• 3+ years leading TPRM programs or teams.
• Experience evaluating controls per ISO 27001, NIST, SOC 1/2, PCI DSS, and privacy laws.

Responsibilities

• Lead day-to-day execution of the Third-Party Risk Management program.
• Maintain and enhance TPRM policies, standards, procedures, and governance.
• Drive maturity, automation, and process optimization of the program.
• Develop KPIs, KRIs, SLAs, and executive reporting.
• Present risks to senior leadership and governance committees.
• Manage vendor risk assessments, documentation, and remediation recommendations.
• Mentor TPRM analysts and drive continuous improvement.

Skills

Vendor risk assessment

Cybersecurity

Stakeholder management

Reporting & metrics

GRC and TPRM platforms

Education

Bachelor's degree in Information Security / related field

Tools

OneTrust

ServiceNow

Archer

ProcessUnity

AuditBoard

Job description

Ralph Lauren seeks a Third-Party Risk Management (TPRM) Manager to lead the program across the vendor lifecycle, aligning information security, privacy, compliance, and business needs. Partner with Procurement, Legal, Privacy, and IT Security to identify, assess, and mitigate third-party risks while driving program maturity and reporting.

The role requires executive communication, strong risk judgment, and experience with TPRM platforms.