Security Third Party Risk Management Lead

Responsibilities

• Own and drive operational execution of the third-party risk management program, including vendor risk assessments, security contract terms, and continuous monitoring.
• Serve as the subject-matter expert for vendor security review methodology, vendor tiering, and risk treatment decisions.
• Lead vendor risk assessments and apply and refine security policies and standards for cloud, contractor, software, hardware, and data-center engagements.
• Identify workflow inefficiencies and implement improvements that increase effectiveness, quality, and scalability.
• Coordinate operational work, escalations, assessments, and projects across the team.
• Mentor Third Party Risk Management Specialists on assessment methodology, risk decisions, tooling, and best practices.
• Assess risk findings, compensating controls, policy exceptions, and acceptable risk thresholds; serve as the escalation point for complex cases.
• Support negotiation of security contract terms and maintain guidance for Contracts and Legal teams.
• Coordinate with Sourcing, Contracts, Legal, Privacy, and Security teams across the vendor lifecycle.
• Support the design and improvement of Procurement/GRC tools and AI workflows.
• Report third-party risk posture and program operations to security leadership.

Requirements

• 8+ years of experience in Security GRC.
• Deep, hands-on experience operating a third-party or vendor risk program end to end.
• Subject-matter expertise in security control frameworks, including ISO 27001, SOC 2, PCI, and NIST 800-53.
• Understanding of security contract terms and vendor negotiation support.
• Experience mentoring peers and providing technical guidance.
• Track record of identifying process inefficiencies and driving operational improvements at scale.
• Strong cross-functional influence and coordination skills.
• Strong organizational, analytical, and interpersonal skills.

Additional Information

• Applicants who progress to the offer stage may be asked to attend an in-person interview at a Cloudflare office or hub.
• The position may require access to information protected under U.S. export control laws; employment may be conditioned on authorization to receive controlled technology without export-license sponsorship.