Director, Strategic Sourcing Enterprise Third-party Risk Process & Governance

Job Description

General Summary:

As a key Team Manager and leader in the Strategic Sourcing function, the Director, Strategic Sourcing Enterprise Third-party Risk Process & Governance leader is responsible for leading the operational execution of the end-to-end third party risk process as a key member of the Central Risk Management team.

This role is responsible for shaping, driving and managing central third-party risk management processes, supporting cross-functional teams, and ensuring consistent application of risk policies and procedures across the third-party/supplier life cycle. The Director will collaborate closely with business owners, risk SMEs, sourcing teams and the rest of the Central Risk Management team to assess, monitor, and mitigate third-party risks, while driving process efficiency and compliance. The leader will play a key role in expanding the current risk processes and implementing the new processes, including driving change management, for more holistic third-party risk management practices across the company.

The leader will work collaboratively with internal Stakeholders, develop sound third party risk approaches, utilize knowledge and expertise of processes, leverage best practices and drive risk visibility and ultimately risk management actions and a transparent enterprise governance process for managing and underwriting risks.

The ideal candidate is a forward-thinking leader with a deep understanding of pragmatic third party risk processes, tools and technology, change management, and user-centric design principles.

This role reports to the Senior Director of Strategic Sourcing Enterprise Third-Party Risk Management and will serve as a key contributor to the enterprise third-party risk management strategy, with a focus on execution, governance and reporting, and continuous improvement.

Key Duties and Responsibilities:

Operational Leadership

• Lead initiatives to implement the expanded third-party risk management processes, including change management
• Manage day-to-day operations of the holistic centralized third-party risk management process.
• Oversee supplier criticality assessments and ensure consistent application of risk evaluation tools.
• Maintain and update the supplier risk repository, including tracking mitigation actions and ownership.
• Support and coordinate risk assessments for critical suppliers in partnership with business leads and risk SMEs.
• Support the development and automation of risk metrics and dashboards for visibility and reporting.
• Assist in maintaining enterprise third-party risk management tools such as the risk appetite matrix and risk mitigation playbooks and ensure alignment with business inputs.

Governance & Compliance

• Support governance forums and escalation processes for individual third-party risks as well as risk themes by coordinating inputs and developing fit for purpose material including reporting, key metrics, and executive summaries
• Ensure compliance with and continue to evolve internal processes, policies, and understanding of regulatory requirements, and industry standards.
• Pro-actively engage risk SMEs and external risk and industry forums and sources to understand potential changes in regulations and laws that could implicate our third-party/supply base and/or risk processes.
• Partner with internal audit, compliance, legal teams and other risk owners across the company to align and continue to evolve risk practices.

Cross-Functional Collaboration & Continuous Improvement

• Work with strategic sourcing and business owners to integrate third-party/supplier landscape insights into risk strategy.
• Collaborate with HR, Communications and business teams to support training and awareness initiatives.
• Serve as a liaison between risk SMEs and business units to ensure effective execution of risk practices.

• Identify opportunities for process optimization and automation.
• Benchmark practices against industry standards and contribute to ongoing enhancements of the TPRM framework.

Leadership & Change Management

• Partner with senior executives, business leaders, DTE, and suppliers to realize the tools and technology evolution to effectively expand and support risk processes
• Align risk processes with overall business objectives and collaborate with key stakeholders to understand evolving risks; own, develop and embed tools and processes to enable consistency, simplification, and sustainability of pragmatic third-party risk management across the business.
• Foster strong partnerships and a culture of continuous and balanced third-party risk mindset and decision-making across the company.

Success Measures

• Increased adoption and satisfaction with third-party risk programs
• Demonstrated value of enhanced third-party risk management practices
• Reduction of process cycle times, and elevated focus on critical third-parties and risks
• High stakeholder engagement and positive business feedback on value and effectiveness of third-party risk programs.

Knowledge and Skills:

• Strong analytical and project management skills.
• Exceptional leadership, communication, and stakeholder management skills.
• Familiarity with third-party risk assessment tools, dashboards, and governance frameworks.
• Ability to lead cross-functional teams and drive operational excellence.
• Track record of delivering measurable outcomes through process transformation, automation, and user experience redesign.
• Thoughtful and active listener; able to think quickly and effectively articulate points of view.

• Ability to work in collaborative, team environment; ability to cultivate and maintain effective business partner relationships through earned respect and trust

• Ability to manage multiple priorities while ensuring deliverables are fully met, including more complex and involved projects.
• Knowledge of regulatory requirements and industry best practices in third-party risk.

Education and Experience:

• Bachelor's degree in Business, Finance, Risk Management, or related field.
• Professional certifications (e.g., CRMA, CTPRP, CISM) preferred.
• 8-12 years of experience in risk management, sourcing, or compliance, preferably in a biopharma or regulated industry.
• Experience managing third-party risk programs or supplier risk assessments

Pay Range:

Disclosure Statement:

Flex Designation:

Flex Eligibility Status:

In this Hybrid-Eligible role, you can choose to be designated as:
1. Hybrid: work remotely up to two days per week; or select
2. On-Site: work five days per week on-site with ad hoc flexibility.

Note: The Flex status for this position is subject to Vertex's Policy on Flex @ Vertex Program and may be changed at any time.

Company Information

Vertex is a global biotechnology company that invests in scientific innovation.

Vertex is committed to equal employment opportunity and non-discrimination for all employees and qualified applicants without regard to a person's race, color, sex, gender identity or expression, age, religion, national origin, ancestry, ethnicity, disability, veteran status, genetic information, sexual orientation, marital status, or any characteristic protected under applicable law. Vertex is an E-Verify Employer in the United States. Vertex will make reasonable accommodations for qualified individuals with known disabilities, in accordance with applicable law.

Any applicant requiring an accommodation in connection with the hiring process and/or to perform the essential functions of the position for which the applicant has applied should make a request to the recruiter or hiring manager, or contact Talent Acquisition at ApplicationAssistance@vrtx.com