We are seeking an experienced Director, Third Party Risk Management (TPRM) and Technical Information Security Lead (TISL). This is a leadership role combining enterprise‑level ownership of the Third‑Party Risk Management program with business‑facing technical security risk leadership across critical initiatives and platforms.

This role will set the overall third-party security strategy, standards, and operating models for managing cyber risk across a complex ecosystem of vendors, partners, and internal technologies, while acting as a trusted security advisor to executive and senior business leaders. This role is pivotal in balancing risk, regulatory compliance, speed, and innovation in a highly regulated environment.

What You Will Achieve

TPRM Program Strategy & Ownership

• Own the enterprise Third Party Risk Management (TPRM) security strategy, program, and operating model.
• Align TPRM with enterprise cyber risk appetite, business priorities, and pharmaceutical regulatory expectations.
• Establish scalable approaches for risk tiering, assessment depth, reassessment cadence, continuous monitoring, and exception governance.
• Align the TPRM program with Pfizer’s enterprise cyber risk appetite and business strategy.

Third‑Party Cyber Risk Oversight & Governance

• Provide executive‑level oversight and approval for high‑risk and critical vendor risk assessments.
• Lead governance for risk treatment decisions, including remediation prioritization, compensating controls, and formal risk acceptances.
• Escalate material vendor risks to enterprise risk committees and executive leadership, enabling informed decision‑making.

Technical Information Security Lead

• Serve as a senior Technical Information Security Lead for high‑impact business initiatives, platforms, and transformations.
• Serve as the trusted cybersecurity risk advisor to executive-level business and technology leaders.
• Translate complex technical risks into executive‑level insights and decision‑ready recommendations.

Leadership & Influence

• Serve as an executive GRC partner to Procurement, Legal, Privacy, Quality, Security, Internal Audit, and Business Leadership.
• Influence contract standards and onboarding requirements to embed security, privacy, and resilience controls into third‑party agreements.
• Represent GRC in executive forums, governance bodies, and cross‑functional steering committees.
• Set strategic priorities and outcomes; delegate execution while maintaining accountability.
• Drive talent development, succession planning, and capability maturity across the function.

Here Is What You Need (Minimum Requirements)

• Bachelor’s degree with at least 8+ years of experience; OR a Master’s degree with more than 7+ years of experience; OR a Ph.D. with 5+ years of experience.
• 8+ years of experience in cybersecurity, cyber risk, GRC, TPRM, security architecture, IT risk, or audit, ideally within the pharmaceutical or other highly regulated industries.
• Experience leading and developing teams, including direct people management responsibility for technical and cybersecurity professionals.
• Demonstrated experience leading complex risk programs involving multiple stakeholders and competing priorities.
• Strong strategic thinking, analytical, and problem‑solving capabilities with the ability to interpret risk data and drive informed decision‑making.
• Exceptional communication and interpersonal skills, with the ability to collaborate effectively across functions.
• Strong organizational and leadership skills, including the ability to guide teams, manage change, and drive continuous program improvement.
• Demonstrated experience in an agile work environment possessing qualities such as a collaborative mindset, adaptability to change, and a proactive problem-solving approach.

Bonus Points If You Have (Preferred Requirements)

• Advanced degree (MBA, MS in Risk Management, Information Security, or related discipline).
• Experience developing or maturing enterprise‑wide TPRM or broader risk governance programs in complex, global organizations.
• Background in highly regulated industries with strong familiarity with regulatory expectations related to third‑party oversight.
• Relevant certifications such as CISSP, CISM, CRISC, CISA, PMP, or other governance/risk credentials.
• Experience leading or supporting the adoption of AI and digital technologies to improve operational efficiency, risk management, decision-making, or security outcomes preferred.

PHYSICAL/MENTAL REQUIREMENTS

• No special physical requirements
• Applicants should be capable of working through a personal laptop computer or mobile device for extended periods.

NON-STANDARD WORK SCHEDULE, TRAVEL OR ENVIRONMENT REQUIREMENTS

• Travel as required by the business (less than 5% domestic and/or international)
• Work Location Assignment: Must be able to work in assigned Pfizer office 2-3 days per week, or as needed by the business
• This role is NOT remote

Work Location Assignment: Hybrid

Relocation assistance may be available based on business needs and/or eligibility.