Supply Chain Security, Vice President

BlackRock•Wilmington, NY

10h•$138,000 - $215,000•Hybrid

About The Position

BlackRock’s Supply Chain Security team identifies, assesses, and manages cybersecurity risks associated with third-party service providers. The Vice President will lead the Critical Providers & Emerging Risk pillar, overseeing security engagement and ongoing monitoring for the firm’s most critical providers, particularly financial institutions and providers supporting critical business services. The role will strengthen coordination between Supply Chain Security, the Provider Strategy Group, and other risk functions to enable proactive, integrated oversight. The position will lead capabilities for identifying emerging cyber threats and vulnerabilities across the vendor population, establish a security framework for providers supporting tokenization and digital assets, and use automation to improve the scale and effectiveness of Supply Chain Security operations. It will work across Information Security, Threat Intelligence, Provider Strategy Group, Digital Assets, Technology, Risk, Legal, Sourcing, and business teams, and communicate material risks and recommendations to senior leaders and governance forums. BlackRock’s hybrid work model requires employees to work in the office at least four days per week, with the flexibility to work from home one day per week. Some business groups may require more in-office time. The position is offered with location-specific salary ranges for New York, NY ($162,000–$215,000), Washington, DC ($148,000–$200,000), and Wilmington, DE ($138,000–$186,500). Employees are eligible for an annual discretionary bonus. BlackRock describes additional benefits including healthcare, leave and retirement benefits, tuition reimbursement, support for working parents, and Flexible Time Off.

Requirements

At least 8 years of experience in financial services, cybersecurity, technology risk, third-party risk, or a related field.
Demonstrated experience developing or leading cybersecurity, security risk, or third-party risk programs.
Experience with cyber threat intelligence, emerging cybersecurity risks, and vulnerability management.
Strong understanding of cybersecurity risks associated with third-party service providers and critical business services.
Ability to lead cross-functional initiatives and translate complex cybersecurity issues into clear business risks and actionable recommendations.
Strong written, verbal, and senior stakeholder communication skills.
Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Risk Management, Finance, or a related discipline, or equivalent professional experience.

Nice To Haves

Experience in financial services or another highly regulated environment.
Experience with digital assets, blockchain, tokenization, or associated security risks.
Experience using automation and data-driven approaches to improve cybersecurity or risk-management processes.
CISSP, CISM, CRISC, or an equivalent cybersecurity or risk-management certification; preferred but not required.

Responsibilities

Serve as a senior Information Security liaison for Critical Service Providers, providing security oversight and coordinating with providers, business owners, and internal risk partners.
Develop and manage ongoing security monitoring and health checks for Critical Service Providers to identify changes in security posture, incidents, vulnerabilities, and emerging risks.
Improve the Provider Strategy Group engagement model, including preparation for provider engagements, information sharing, finding management, remediation tracking, and escalation of material risks.
Build proactive security monitoring and engagement for Critical Service Providers between periodic assessments and formal Resiliency Health Checks.
Lead vulnerability impact analysis for significant cyber vulnerabilities, threats, and incidents affecting critical third-party providers, including intake, triage, impact assessment, outreach, evidence collection, remediation tracking, escalation, and closure reporting.
Develop security and resiliency requirements for service providers supporting tokenization of funds and digital assets, including tokenization platforms, custody solutions, blockchain infrastructure, and related services.
Partner with internal risk, security, technology, digital asset, legal, sourcing, provider strategy, and business teams to evaluate material third-party security risks and drive appropriate actions.
Implement automation and data-driven processes to improve vendor monitoring, risk identification, provider outreach, evidence collection, workflow management, and reporting.
Identify recurring risks and lessons across the provider population and use them to improve Supply Chain Security requirements, monitoring, and assessment processes.
Communicate material third-party cybersecurity risks and recommendations to senior leadership and relevant governance forums.