Service Manager – Supplier Security Due Diligence & Monitoring Service

Ideal Candidate 

• Strong risk leader with the ability to distinguish between acceptable contractual deviations, temporary accommodations, material control weaknesses, and risks requiring formal escalation or acceptance. 

• Proven operational leader capable of building structure, driving consistency, and managing a high-demand service with multiple stakeholders and competing priorities. 

• Brings strong understanding of how information security requirements translate into contractual obligations and can evaluate legal language through a practical risk lens. 

• Highly disciplined in governance, documentation, exception management, and maintaining defensible audit trails for risk decisions. 

• Demonstrated ability to influence legal, procurement, business, security, and supplier stakeholders without direct authority. 

• Pragmatic and commercially aware, balancing risk management objectives with business outcomes and supplier realities. 

• Service-oriented leader committed to responsiveness, consistency, stakeholder experience, and operational excellence. 

Success Measures 

• Consistent application of enterprise risk tolerances and contractual security standards. 

• Achievement of service-level commitments and stakeholder satisfaction objectives. 

• Effective documentation, governance, and escalation of security control exceptions and contractual deviations. 

• Reduction in unmanaged contractual security risk across supplier agreements. 

• Operational maturity demonstrated through scalable processes, metrics, reporting, and continuous improvement. 

• Development of a high-performing team capable of delivering consistent, risk-informed contracting outcomes. 

Key Responsibilities 

• Lead the Supplier Security Due Diligence & Monitoring Service and oversee day-to-day service delivery. 

• Manage and develop a team responsible for supplier security contracting support and risk-based decision making. 

• Review and interpret supplier security assessment outcomes and monitoring results to guide contractual negotiations. 

• Provide guidance on acceptable contractual security positions, fallback language, compensating controls, and alternative risk mitigation approaches. 

• Ensure consistent application of enterprise security requirements across supplier agreements. 

• Oversee documentation and tracking of contractual exceptions, deviations, and risk accommodations. 

• Escalate contractual positions that exceed established risk tolerances through appropriate governance and risk acceptance processes. 

• Partner closely with Legal, Procurement, Cybersecurity, Enterprise Risk Management, and business stakeholders to resolve complex supplier issues. 

• Establish and maintain operational metrics, service-level objectives, reporting, and quality management practices. 

• Lead continuous improvement efforts designed to improve scalability, consistency, and stakeholder experience. 

Required Qualifications 

• 7+ years of experience in information security, technology risk, third-party risk management, supplier risk management, governance, contracting, procurement, or related disciplines. 

• 3+ years of leadership experience managing teams, services, programs, or operational functions. 

• Experience evaluating cybersecurity and technology risks and applying sound risk-based decision-making principles. 

• Strong understanding of supplier risk management, security controls, and governance practices. 

• Experience working across legal, procurement, business, security, and risk management functions. 

• Excellent written, verbal, stakeholder management, and executive communication skills. 

Preferred Qualifications 

• Experience supporting supplier contract negotiations involving cybersecurity and privacy requirements. 

• Knowledge of third-party risk management programs and supplier security assessment methodologies. 

• Experience with cybersecurity frameworks and standards such as NIST Cybersecurity Framework, NIST 800-53, ISO 27001, CIS Controls, and SOC reporting. 

• Experience with enterprise risk management, governance, and risk acceptance processes. 

• Professional certifications such as CISSP, CISM, CRISC, ITIL, PMP, or related credentials. 

• Experience building, scaling, or transforming operational services and governance functions.