Ready to join a team that’s all in? At Imprivata, we deliver unified access and security management programs that eliminate friction, empowering healthcare and mission-critical organizations to work smarter, faster, and more securely.
We believe work can be more than a job or task—it’s a collective spirit; the type that emboldens creativity, embraces challenge, and fosters excitement. We are constantly raising the bar on what’s possible, owning the outcome of our triumphs and trials, staying nimble amidst change, and cultivating an environment where we win together. Here, your ideas matter, your differences are celebrated, and your work drives real results—for your career, your teammates, and our customers.
When you join Imprivata, you embark on a shared journey of ambition and growth. We’re committed to building an inclusive workplace where everyone feels valued and supported. If you’re looking for a place to match your passion with purpose—and where every day you can make an impact—you’ll find it here.
Job Summary
The Third-Party Risk Manager is primarily responsible for leading and maturing Imprivata's third-party risk management program, with a focus on cybersecurity, data privacy, and AI governance across Imprivata's business units. Reporting to the Director, Privacy & Compliance Counsel, and working as a peer alongside the Privacy & Vendor Contracts Manager, this role co-owns the full TPRM program lifecycle, including continuous monitoring, Nth-party risk visibility, and software supply chain security. The position will work alongside the commercial legal, privacy, security, and procurement teams to support vendor risk assessment, data protection, and AI governance initiatives. The position requires a driven, self-directed professional who brings strong critical thinking, clear communication, and initiative to complex risk decisions, and who can provide high-quality work product with minimal supervision in a fast-paced, high-energy environment.
- Lead Imprivata’s third-party risk program across cybersecurity, privacy, and AI governance. Independently prioritize work, recommend mitigations, and escalate material risks for acceptance.
- Conduct security, privacy, and AI risk assessments of vendors and service providers, reviewing certifications, audit reports, questionnaires, penetration tests, data flows, software bills of materials, and AI disclosures.
- Evaluate vendor data collection, retention, sharing, and transfers against applicable privacy requirements, and assess inherent and residual risk.
- Use security ratings and continuous monitoring tools to identify changes in vendor risk and emerging issues.
- Manage the vendor risk lifecycle, including onboarding, periodic reviews, offboarding, inventory, risk classification, and confirmation of data return or destruction.
- Map Nth-party dependencies and concentration risks; review security, privacy, and AI contract terms, including data protection, subprocessor, breach notice, and business associate requirements.
- Track remediation through closure, maintain clear records, and build constructive relationships with vendors and internal partners to resolve issues promptly.
- Partner with Legal, Privacy, Security, Procurement, AI Governance, and business owners to communicate findings, maintain metrics and reports, improve workflows, and train stakeholders.
- Assess vendor AI practices, including data use, model training and provenance, and third-party integrations. Apply recognized AI risk frameworks and support governance policies and assessment playbooks.
- Maintain evidence and support audits, regulatory inquiries, and governance reporting. Monitor relevant security, privacy, and AI standards and laws, including ISO, NIST, HIPAA, GDPR, DORA, NIS2, and applicable regional requirements.
- Perform other duties as assigned and required.
Qualifications
- 5–7 years of experience in third-party/vendor risk, information security, IT audit, compliance, or governance, including SaaS risk assessments and cross-functional work. Bachelor’s degree in a related field required; healthcare or regulated-industry experience preferred. JD or equivalent legal education is a plus. CTPRP, CRISC, CISA, CISM, CISSP, or AIGP certification preferred.
- Strong written and verbal communication, sound judgment, and a collaborative, practical approach. Able to prioritize work, meet deadlines, advise executives, and adapt in a changing environment.
- Experience building or improving risk programs, assessments, playbooks, and scalable processes. Able to analyze contractual, privacy, security, and AI issues and provide concise, business-focused guidance; familiarity with procurement and vendor pricing is helpful.
- Proficiency with Microsoft 365 and relevant business systems, TPRM/GRC platforms, security-rating tools, and contract lifecycle management systems. Experience with AI-assisted contract review tools is beneficial.
- Working knowledge of security, privacy, and AI frameworks and regulations, such as NIST CSF, NIST AI RMF, NIST 800-53, ISO 27001/27701/42001, HIPAA, GDPR, DORA, NIS2, the EU AI Act, and U.S. state privacy laws. Familiarity with SIG, CAIQ, or similar assessment tools.
#LI-Remote #LI-SF1
Skills Required
- 5-7 years of experience in third-party/vendor risk, information security, IT audit, compliance, or governance
- Experience with SaaS risk assessments and cross-functional work
- Bachelor's degree in a related field
- Strong written and verbal communication, sound judgment, and collaborative approach
- Ability to prioritize work, meet deadlines, advise executives, and adapt to change
- Experience building or improving risk programs, assessments, playbooks, and scalable processes
- Ability to analyze contractual, privacy, security, and AI issues and provide business-focused guidance
- Proficiency with Microsoft 365, business systems, TPRM/GRC platforms, security-rating tools, and contract lifecycle management systems
- Working knowledge of security, privacy, and AI frameworks and regulations, including NIST, ISO, HIPAA, GDPR, DORA, NIS2, EU AI Act, and U.S. state privacy laws
- Healthcare or regulated-industry experience
- JD or equivalent legal education
- CTPRP, CRISC, CISA, CISM, CISSP, or AIGP certification
- Familiarity with procurement and vendor pricing
- Experience with AI-assisted contract review tools
- Familiarity with SIG, CAIQ, or similar assessment tools
What the Team is Saying
.jpg)
.jpg)
Imprivata Compensation & Benefits Highlights
-
Healthcare Strength — Medical coverage includes company funding of half the deductible via HSA/HRA alongside medical, dental, and vision options; feedback suggests healthcare is one of the stronger aspects of the package.
-
Leave & Time Off Breadth — A flexible time-off policy is promoted rather than a fixed vacation bank, and feedback suggests this flexibility supports work-life balance in many teams.
-
Parental & Family Support — Paid parental leave and caregiver resources via Care.com, plus dependent and domestic-partner coverage, indicate a family-oriented set of benefits that goes beyond basic insurance.
Imprivata Insights
What We Do
For more than two decades, Imprivata has been redefining how life- and mission-critical industries secure and manage digital identities. We empower healthcare and enterprise organizations to enable fast, compliant, and secure access to technology—allowing clinicians and staff to stay focused on what matters most: patient care and operational excellence. Our digital identity platform is purpose-built for complex environments where every second counts and security can never take a back seat. From authentication and access management to device, application, and identity governance, Imprivata provides a unified approach that balances usability with protection. Trusted by the world’s leading healthcare systems and enterprises in over 45 countries, we deliver solutions that improve efficiency, safeguard data, and drive digital transformation. At Imprivata, our commitment goes beyond technology—we partner closely with our customers to ensure their success, every step of the way.
Why Work With Us
At Imprivata, every voice matters. We’re a global team driven by innovation, compassion, and collaboration. Together, we live our values—Raise the Bar, Own the Outcome, Stay Nimble, and Win Together—while making a real impact on healthcare, technology, and the communities we serve.
Gallery
.jpg)
.jpg)
Imprivata Offices
Hybrid Workspace
Employees engage in a combination of remote and on-site work.
Imprivata offers a flexible hybrid work model with three in-office days and two remote. Collaboration is key, and schedules are coordinated with managers to balance flexibility and connection.
