Director, Third-Party Risk Management and Technical Information Security Lead

Pfizer • New York City, NY

22h • Hybrid

About The Position

Our Global Governance, Risk, and Compliance (GRC) team provides comprehensive blueprints for cybersecurity excellence by embedding governance, risk management, and compliance into every layer. The team is responsible for ensuring risk-based decision-making is used and that security, privacy, and regulatory compliance is integrated seamlessly with Pfizer’s organization. We are seeking an experienced Director, Third Party Risk Management (TPRM) and Technical Information Security Lead (TISL). This is a leadership role combining enterprise‑level ownership of the Third‑Party Risk Management program with business‑facing technical security risk leadership across critical initiatives and platforms. This role will set the overall third-party security strategy, standards, and operating models for managing cyber risk across a complex ecosystem of vendors, partners, and internal technologies, while acting as a trusted security advisor to executive and senior business leaders. This role is pivotal in balancing risk, regulatory compliance, speed, and innovation in a highly regulated environment.

Requirements

• Bachelor’s degree with at least 8+ years of experience; OR a Master’s degree with more than 7+ years of experience; OR a Ph.D. with 5+ years of experience.
• 8+ years of experience in cybersecurity, cyber risk, GRC, TPRM, security architecture, IT risk, or audit, ideally within the pharmaceutical or other highly regulated industries.
• Experience leading and developing teams, including direct people management responsibility for technical and cybersecurity professionals.
• Demonstrated experience leading complex risk programs involving multiple stakeholders and competing priorities.
• Strong strategic thinking, analytical, and problem‑solving capabilities with the ability to interpret risk data and drive informed decision‑making.
• Exceptional communication and interpersonal skills, with the ability to collaborate effectively across functions.
• Strong organizational and leadership skills, including the ability to guide teams, manage change, and drive continuous program improvement.
• Demonstrated experience in an agile work environment possessing qualities such as a collaborative mindset, adaptability to change, and a proactive problem-solving approach.
• Applicants should be capable of working through a personal laptop computer or mobile device for extended periods.
• Permanent work authorization in the United States.

Nice To Haves

• Advanced degree (MBA, MS in Risk Management, Information Security, or related discipline).
• Experience developing or maturing enterprise‑wide TPRM or broader risk governance programs in complex, global organizations.
• Background in highly regulated industries with strong familiarity with regulatory expectations related to third‑party oversight.
• Relevant certifications such as CISSP, CISM, CRISC, CISA, PMP, or other governance/risk credentials.
• Experience leading or supporting the adoption of AI and digital technologies to improve operational efficiency, risk management, decision-making, or security outcomes preferred.

Responsibilities

• Own the enterprise Third Party Risk Management (TPRM) security strategy, program, and operating model.
• Align TPRM with enterprise cyber risk appetite, business priorities, and pharmaceutical regulatory expectations.
• Establish scalable approaches for risk tiering, assessment depth, reassessment cadence, continuous monitoring, and exception governance.
• Align the TPRM program with Pfizer’s enterprise cyber risk appetite and business strategy.
• Provide executive‑level oversight and approval for high‑risk and critical vendor risk assessments.
• Lead governance for risk treatment decisions, including remediation prioritization, compensating controls, and formal risk acceptances.
• Escalate material vendor risks to enterprise risk committees and executive leadership, enabling informed decision‑making.
• Serve as a senior Technical Information Security Lead for high‑impact business initiatives, platforms, and transformations.
• Serve as the trusted cybersecurity risk advisor to executive-level business and technology leaders.
• Translate complex technical risks into executive‑level insights and decision‑ready recommendations.
• Serve as an executive GRC partner to Procurement, Legal, Privacy, Quality, Security, Internal Audit, and Business Leadership.
• Influence contract standards and onboarding requirements to embed security, privacy, and resilience controls into third‑party agreements.
• Represent GRC in executive forums, governance bodies, and cross‑functional steering committees.
• Set strategic priorities and outcomes; delegate execution while maintaining accountability.
• Drive talent development, succession planning, and capability maturity across the function.

Benefits

• 401(k) plan with Pfizer Matching Contributions and an additional Pfizer Retirement Savings Contribution
• Paid vacation, holiday and personal days
• Paid caregiver/parental and medical leave
• Health benefits to include medical, prescription drug, dental and vision coverage
• Relocation assistance may be available based on business needs and/or eligibility.

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: Ph.D. or professional degree