IT Third-Party Risk Management TPRM Manager

Ref #

W181352

State/Region

New Jersey

Department

Information Technology

Location

United States

City

Nutley

Pay Range: The pay range for this job is $0 - $0 annually; actual pay is dependent on experience and geographic location.

Benefits: Base pay is only one part of our employee value proposition, which includes a robust benefits package, above-market time off, hybrid working arrangements, incentive compensation, where applicable, and varied learning opportunities.

COMPANY DESCRIPTION

Ralph Lauren Corporation (NYSE:RL) is a global leader in the design, marketing and distribution of premium lifestyle products in five categories: apparel, accessories, home, fragrances, and hospitality. For more than 50 years, Ralph Lauren's reputation and distinctive image have been consistently developed across an expanding number of products, brands and international markets. The Company's brand names, which include Ralph Lauren, Ralph Lauren Collection, Ralph Lauren Purple Label, Polo Ralph Lauren, Double RL, Lauren Ralph Lauren, Polo Ralph Lauren Children, Chaps, among others, constitute one of the world's most widely recognized families of consumer brands.

At Ralph Lauren, we unite and inspire the communities within our company as well as those in which we serve by amplifying voices and perspectives to create a culture of belonging, ensuring inclusion, and fairness for all. We foster a culture of inclusion through: Talent, Education & Communication, Employee Groups and Celebration.

POSITION OVERVIEW

The Third-Party Risk Management (TPRM) manager is responsible for leading and enhancing Ralph Lauren's Third-Party Risk Management program. This role oversees the assessment, monitoring, and reporting of third-party risks across the vendor lifecycle, ensuring alignment with information security, privacy, compliance, regulatory, and business requirements.

The successful candidate will partner with Procurement, Legal, Privacy, Information Security, Internal Audit, and business stakeholders to identify, assess, and mitigate risks associated with third-party providers while supporting enterprise risk management objectives. The role will also drive program maturity, operational efficiency, reporting, and continuous improvement initiatives.

ESSENTIAL DUTIES & RESPONSIBILITIES

The position will independently perform the following:

Program Leadership

• Manage day-to-day execution of the Third-Party Risk Management program.
• Maintain and enhance TPRM policies, standards, procedures, and governance frameworks.
• Drive program maturity improvements, automation initiatives, and process optimization.
• Establish and monitor TPRM KPIs, KRIs, SLAs, and reporting metrics.

Risk Assessments & Due Diligence

• Lead risk assessments of new and existing third-party providers.
• Review SIG questionnaires, SOC reports, ISO certifications, penetration testing reports, and other security documentation.
• Evaluate information security, privacy, compliance, operational, and resilience risks.
• Document findings, develop risk assessments, and provide recommendations for remediation.

Risk Governance & Oversight

• Facilitate risk acceptance, exception management, and escalation processes.
• Present significant third-party risks to senior leadership and governance committees.
• Ensure consistent application of risk-tiering methodologies and review requirements.
• Support audits, regulatory inquiries, and compliance initiatives.

Stakeholder Management

• Serve as the primary point of contact for business stakeholders regarding third-party risk requirements.
• Partner with Procurement, Legal, Privacy, Architecture, Security Engineering, and business units throughout the vendor lifecycle.
• Provide guidance on security and compliance requirements during vendor onboarding and contract negotiations.

Reporting & Analytics

• Develop executive-level dashboards and reporting related to vendor risk posture, assessment volumes, remediation status, SLA performance, and program health.
• Track and report findings, remediation progress, and emerging third-party risks.
• Provide actionable insights to leadership to support informed risk decisions.

Team Leadership

• Manage and mentor TPRM analysts and/or external consultants.
• Establish quality standards for risk assessments and deliverables.
• Promote a culture of accountability, operational excellence, and continuous improvement.

EXPERIENCE, SKILLS & KNOWLEDGE

Education

• Bachelor's degree in Information Security, Cybersecurity, Information Technology, Business Administration, Risk Management, or related field.

Experience

• 7+ years of experience in Information Security, IT Risk Management, Cybersecurity, Compliance, Internal Audit, or Third-Party Risk Management.
• 3+ years of experience managing TPRM programs or teams.
• Experience evaluating security controls and industry standards such as ISO 27001, NIST, SOC 1, SOC 2, PCI DSS, and privacy regulations.

Skills

• Strong vendor risk assessment and risk analysis capabilities.
• Knowledge of cybersecurity, privacy, and regulatory requirements.
• Exceptional stakeholder management and communication skills.
• Strong reporting, metrics, and executive presentation skills.
• Experience with GRC and TPRM platforms (e.g., OneTrust, ServiceNow, Archer, ProcessUnity, AuditBoard).

Preferred Qualifications

• CISSP, CISM, CRISC, CISA, CGEIT, or equivalent certification.
• Experience in retail, consumer products, or global enterprise environments.
• Experience implementing TPRM automation and workflow solutions.
• Knowledge of privacy regulations and data protection frameworks.

Ralph Lauren will consider for employment qualified applicants with arrest or conviction records in a manner consistent with the requirements of the law, including any applicable fair chance laws. Please note background checks will be evaluated individually.