Director, Third-Party Risk Management and Technical Information Security Lead

Use Your Power for Purpose
Our Global Governance, Risk, and Compliance (GRC) team provides comprehensive blueprints for cybersecurity excellence by embedding governance, risk management, and compliance into every layer. The team is responsible for ensuring risk-based decision-making is used and that security, privacy, and regulatory compliance is integrated seamlessly with Pfizer's organization.
We are seeking an experienced Director, Third Party Risk Management (TPRM) and Technical Information Security Lead (TISL). T his is a leadership role combining enterprise‑level ownership of the Third‑Party Risk Management program with business‑facing technical security risk leadership across critical initiatives and platforms.
This role will set the overall third-party security strategy, standards, and operating models for managing cyber risk across a complex ecosystem of vendors, partners, and internal technologies, while acting as a trusted security advisor to executive and senior business leaders. This role is pivotal in balancing risk, regulatory compliance, speed, and innovation in a highly regulated environment.
What You Will Achieve
TPRM Program Strategy & Ownership

• Own the enterprise Third Party Risk Management (TPRM) security strategy, program, and operating model.
• Align TPRM with enterprise cyber risk appetite, business priorities, and pharmaceutical regulatory expectations.
• Establish scalable approaches for risk tiering, assessment depth, reassessment cadence, continuous monitoring, and exception governance.
• Align the TPRM program with Pfizer's enterprise cyber risk appetite and business strategy.

Third‑Party Cyber Risk Oversight & Governance

• Provide executive‑level oversight and approval for high‑risk and critical vendor risk assessments.
• Lead governance for risk treatment decisions, including remediation prioritization, compensating controls, and formal risk acceptances.
• Escalate material vendor risks to enterprise risk committees and executive leadership, enabling informed decision‑making.

Technical Information Security Lead

• Serve as a senior Technical Information Security Lead for high‑impact business initiatives, platforms, and transformations.
• Serve as the trusted cybersecurity risk advisor to executive-level business and technology leaders.
• Translate complex technical risks into executive‑level insights and decision‑ready recommendations.

Leadership & Influence

• Serve as an executive GRC partner to Procurement, Legal, Privacy, Quality, Security, Internal Audit, and Business Leadership.
• Influence contract standards and onboarding requirements to embed security, privacy, and resilience controls into third‑party agreements.
• Represent GRC in executive forums, governance bodies, and cross‑functional steering committees.
• Set strategic priorities and outcomes; delegate execution while maintaining accountability.
• Drive talent development, succession planning, and capability maturity across the function.

Here Is What You Need (Minimum Requirements)

• Bachelor's degree with at least 8+ years of experience; OR a Master's degree with more than 7+ years of experience; OR a Ph.D. with 5+ years of experience.
• 8+ years of experience in cybersecurity, cyber risk, GRC, TPRM, security architecture, IT risk, or audit, ideally within the pharmaceutical or other highly regulated industries.
• Experience leading and developing teams, including direct people management responsibility for technical and cybersecurity professionals.
• Demonstrated experience leading complex risk programs involving multiple stakeholders and competing priorities.
• Strong strategic thinking, analytical, and problem‑solving capabilities with the ability to interpret risk data and drive informed decision‑making.
• Exceptional communication and interpersonal skills, with the ability to collaborate effectively across functions.
• Strong organizational and leadership skills, including the ability to guide teams, manage change, and drive continuous program improvement.
• Demonstrated experience in an agile work environment possessing qualities such as a collaborative mindset, adaptability to change, and a proactive problem-solving approach.

Bonus Points If You Have (Preferred Requirements)

• Advanced degree (MBA, MS in Risk Management, Information Security, or related discipline).
• Experience developing or maturing enterprise‑wide TPRM or broader risk governance programs in complex, global organizations.
• Background in highly regulated industries with strong familiarity with regulatory expectations related to third‑party oversight.
• Relevant certifications such as CISSP, CISM, CRISC, CISA, PMP, or other governance/risk credentials.
• Experience leading or supporting the adoption of AI and digital technologies to improve operational efficiency, risk management, decision-making, or security outcomes preferred.

PHYSICAL/MENTAL REQUIREMENTS

• No special physical requirements
• Applicants should be capable of working through a personal laptop computer or mobile device for extended periods.

NON-STANDARD WORK SCHEDULE, TRAVEL OR ENVIRONMENT REQUIREMENTS

• Travel as required by the business (less than 5% domestic and/or international)
• Work Location Assignment: Must be able to work in assigned Pfizer office 2-3 days per week, or as needed by the business
• This role is NOT remote

Work Location Assignment: Hybrid
The annual base salary for this position ranges from $176,600.00 to $294,300.00. In addition, this position is eligible for participation in Pfizer's Global Performance Plan with a bonus target of 20.0% of the base salary and eligibility to participate in our share based long term incentive program. We offer comprehensive and generous benefits and programs to help our colleagues lead healthy lives and to support each of life's moments. Benefits offered include a 401(k) plan with Pfizer Matching Contributions and an additional Pfizer Retirement Savings Contribution, paid vacation, holiday and personal days, paid caregiver/parental and medical leave, and health benefits to include medical, prescription drug, dental and vision coverage. Learn more at Pfizer Candidate Site - U.S. Benefits | (uscandidates.mypfizerbenefits.com). Pfizer compensation structures and benefit packages are aligned based on the location of hire. The United States salary range provided does not apply to Tampa, FL or any location outside of the United States. This role is posted in multiple locations. If you are applying for the role in an secondary job posting location where pay transparency regulations apply, your Talent Advisor will share the local pay information with you during the first interview.
Relocation assistance may be available based on business needs and/or eligibility.
Candidates must be authorized to be employed in the U.S. by any employer.
U.S. work visa sponsorship (such as TN, O-1, H-1B, etc.) is not available for this role now or in the future.
Sunshine Act
Pfizer reports payments and other transfers of value to health care providers as required by federal and state transparency laws and implementing regulations. These laws and regulations require Pfizer to provide government agencies with information such as a health care provider's name, address and the type of payments or other value received, generally for public disclosure. Subject to further legal review and statutory or regulatory clarification, which Pfizer intends to pursue, reimbursement of recruiting expenses for licensed physicians may constitute a reportable transfer of value under the federal transparency law commonly known as the Sunshine Act. Therefore, if you are a licensed physician who incurs recruiting expenses as a result of interviewing with Pfizer that we pay or reimburse, your name, address and the amount of payments made currently will be reported to the government. If you have questions regarding this matter, please do not hesitate to contact your Talent Acquisition representative.
EEO & Employment Eligibility
Pfizer is committed to equal opportunity in the terms and conditions of employment for all employees and job applicants without regard to race, color, religion, sex, sexual orientation, age, gender identity or gender expression, national origin, disability or veteran status. Pfizer also complies with all applicable national, state and local laws governing nondiscrimination in employment as well as work authorization and employment eligibility verification requirements of the Immigration and Nationality Act and IRCA. Pfizer is an E-Verify employer. This position requires permanent work authorization in the United States.
Pfizer endeavors to make www.pfizer.com/careers accessible to all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process and/or interviewing, please email [email protected] . This is to be used solely for accommodation requests with respect to the accessibility of our website, online application process and/or interviewing. Requests for any other reason will not be returned.
To learn more about acceptable and prohibited uses of AI during the recruitment process, please review our candidate AI-use guidelines available on Pfizer Careers .
Information & Business Tech
#BI-Hybrid