{"id":2160970,"url":"https://alion.io/job/adidas-third-party-cybersecurity-risk-management","title":"Third Party Cybersecurity Risk Management","company":{"id":40940,"name":"Adidas","domain":"adidas.com","url":"https://alion.io/company/adidas","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Zaragoza, Spain"],"countries":["ES"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":52000,"max_usd":120000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2094},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"GDPR","optional":false},{"name":"ISO 27001","optional":false}],"status":"live","first_seen_at":"2026-10-09T08:23:04Z","employer_posted_date":"2026-10-09","last_verified_at":"2026-10-19T21:37:33Z","board_verified":true,"closed_at":null,"days_open":10,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":10},"description":"At adidas, every day is a chance to flip the script. An invitation to take everything we know and re-invent it. Do it better. Never settling for good enough.\nEvery day we get up, invent, adapt, improvise, find new ways to collaborate,\nand do the unexpected. We’re creators, makers and doers. Helping athletes make\na difference, not just in their games, but in their lives and in their world.\nIt’s an obsession.\nWe’ve been doing this for more than 75 years. With an unmatched history and tradition\nof creating iconic products, consumer connections and experiences, we’ve been defining\nsport culture since the beginning.\nAnd we’re never done.\nCome be a part of shaping the future together with us.\nIT STARTS WITH YOU\nMANAGER INFORMATION SECURITY GOVERNANCE\nINFORMATION SECURITY GOVERNANCE\nPURPOSE:\nThe role is responsible for all efforts to reach a state of continuous compliance by partnering and engaging with our technology, business, and brand teams to adhere to policies, reduce security risks and maintain compliance in the area of Third Party Mgt. Part of overall duties is to establish, maintain and advance the information security governance framework.\nKEY ACCOUNTABILITIES:\nThird Party Risk Management Process Leadership\nOwn and maintain the Third Party Information Security Risk Management process, including procedures, assessment methodology, templates, playbooks and supporting documentation.\nDefine risk-based assessment criteria, supplier segmentation and prioritization logic based on data sensitivity, service criticality, access type, hosting model and business impact.\nDrive process improvement initiatives to increase assessment quality and scope, cycle time, stakeholder experience and audit readiness.\nCoordinate the annual review of the TPRM framework, ensuring alignment with information security policies, enterprise risk management and relevant regulatory expectations.\nThird Party Security Assessments\nLead and coordinate security due diligence for new and existing third parties, including suppliers, outsourced service providers, technology vendors, cloud providers and strategic partners.\nReview third party evidence such as security questionnaires, ISO 27001 certificates, SOC reports, penetration test summaries, business continuity documentation, data protection evidence and remediation plans.\nAssess security risks across relevant control domains including access management, data protection, cloud security, application security, vulnerability management, incident response, business continuity and subcontractor management.\nDetermine residual risk ratings, document assessment outcomes and recommend risk treatment actions aligned to policy and business context.\nThird Party Lifecycle Integration\nPartner with Procurement, Legal, Privacy and business stakeholders to embed security controls into sourcing, onboarding, contracting, renewal, change and exit processes.\nProvide guidance on minimum information security requirements, contractual security clauses, audit rights, breach notification, subcontractor controls, data return and deletion requirements.\nSupport risk-based contract reviews and supplier negotiations where information security risks are material.\nEnsure clear handover points between security assessment, contract execution, operational third party management and recurring review cycles.\nRisk Treatment, Monitoring & Escalation\nTrack remediation actions, exceptions and risk acceptances to closure, ensuring accountable owners, due dates and evidence are documented.\nEscalate critical third party risks, overdue remediation or unresolved risk acceptance decisions to appropriate governance forums.\nDefine and operate monitoring activities for higher-risk third paties, including periodic reassessments, trigger-based reviews and review of external assurance or security rating information where applicable.\nContribute to third-party incident response and post-incident lessons learned when third party security issues occur.\nReporting, Metrics & Audit Readiness\nDevelop and maintain management reporting on assessment volumes, risk ratings, remediation status, overdue items, cycle times, critical third parties and key risk themes.\nPrepare concise executive-level updates, dashboards and decision papers for governance committees and senior stakeholders.\nMaintain assessment records and evidence in a structured and audit-ready manner.\nSupport internal and external audits, regulatory inquiries and assurance reviews related to third-party information security risk.\nTool, Data & Automation Enablement\nAct as business owner or key user for TPRM module in the GRC tool and support configuration of workflows, forms, reporting and data quality controls.\nIdentify opportunities to automate assessments, evidence collection, reminders, reporting and recurring review triggers.\nCollaborate with data and technology teams to improve the completeness and reliability of third party risk data.\nWHAT WE ARE LOOKING FOR:\nProfessional experience\n5+ years of experience in information security, IT risk, cyber risk, third party risk management, audit, compliance or governance.\n3+ years of practical experience with supplier security assessments, vendor risk management, GRC processes or operational risk management.\nExperience working in global, matrixed organizations with cross-functional stakeholders.\nFunctional knowledge\nStrong understanding of information security risk management, third-party due diligence and supplier lifecycle controls.\nKnowledge of common assurance evidence and frameworks such as ISO 27001, SOC reports, NIST Cybersecurity Framework, NIST SP 800-161, GDPR and cloud security good practices.\nUnderstanding of contractual security requirements, risk acceptance, remediation tracking and audit evidence expectations.\nSkills and behaviours\nAbility to translate technical security risks into practical business language and actionable recommendations.\nStrong stakeholder management, communication, facilitation and negotiation skills.\nStructured, detail-oriented and able to manage multiple priorities in a fast-moving environment.\nComfortable using data, dashboards and metrics to drive decisions and process improvement.\nAbility to influence without direct authority and build trust with senior stakeholders and suppliers.\nTools and methods\nExperience with GRC or TPRM platforms, workflow tools, supplier repositories and reporting dashboards.\nAbility to work with assessment questionnaires, control mappings, issue registers and evidence repositories.\nExperience with process improvement, automation or Lean ways of working is beneficial.\nOTHER RESPONSIBILITIES\nEnterprise Information Security governance\nReviews current and proposed information systems for compliance with the organization’s obligations (including legislation, regulatory, contractual and agreed standards/policies) and adherence to overall strategy.\nProvides specialist advice to those accountable for governance to correct compliance issues.\nInformation governance\nAssesses and manages risks around the use of information.\nProvides reports on the consolidated status of information controls to inform effective decision making.\nRecommends remediation actions as required.\nEnsures that information is presented effectively.\nInformation security\nProvides advice and guidance on security strategies to manage identified risks and ensure adoption and adherence to standards.\nObtains and acts on vulnerability information and conducts security risk assessments, business impact analysis and accreditation on complex information systems.\nInvestigates major breaches of security and recommends appropriate control improvements.\nContributes to development of information security policy, standards and guidelines.\nInformation assurance\nInterprets information assurance and security policies and applies these in order to manage risks.\nProvides advice and guidance to ensure adoption of and adherence to information assurance architectures, strategies, policies, standards and guidelines.\nUses testing to support information assurance.\nContributes to the development of policies, standards and guidelines.\nBusiness risk management\nCarries out risk assessment within a defined functional or technical area of business.\nUses consistent processes for identifying potential risk events, quantifying and documenting the probability of occurrence and the impact on the business.\nRefers to domain experts for guidance on specialized areas of risk, such as architecture and environment.\nCo-ordinates the development of countermeasures and contingency plans.\nConformance review\nConducts formal reviews of activities, processes, products or services.\nCollects, collates and examines records as part of specified testing strategies for evidence of compliance with management directives, or the identification of abnormal occurrences.\nAnalyses evidence collated and drafts part or all of formal reports commenting on the conformance found to exist in the reviewed part of an information systems environment.\nRelationship management\nImplements stakeholder engagement/communications plan.\nDeals with problems and issues, managing resolutions, corrective actions, lessons learned and the collection and dissemination of relevant information.\nCollects and uses feedback from customers and stakeholders to help measure effectiveness of stakeholder management.\nHelps develop and enhance customer and stakeholder relationships.\nKEY RELATIONSHIPS\nGlobal Tech and Product Areas\nRespective business function (GOPS, Finance, HR, Brand Marketing, Wholesale/Retail)\nProcurement\nLegal\nHR Management\nMarkets\nWHAT IF I DON’T CHECK ALL THE BOXES?\nIt’s ok if some of the technology or terminology mentioned here are new for you. We’ll happily teach you.\nAt adidas, we’re keen to increase our team’s diversity of backgrounds and skills, and we’re more interested in the work you will produce than that work you’ve already produced in the past. If you’d love to work with us, then we’d love to hear from you.\nWHAT WE OFFER:\nYou will be part of a company where digital transformation, innovation and continuous improvement are core principles of our culture.\nYou will join a team of talented and passionate quality engineers, with a lot of opportunities to grow and reach your expectations.\nYou will be part of a highly engaged, multinational with international career opportunities.\nIndividual development, training and a tech community.\nHybrid Work Setup: enjoy the advantages of a flexible remote work environment (40% Weekly) combined with the amazing onsite facilities and culture.\nCompetitive salary, benefits and valuable discounts on adidas products.\nSound good? Apply here and be part of our tomorrow.\nNot the right job for you? There are thousands of opportunities at\nadidas around the world. Find the one with your name on it.\nWant to get a behind the scenes look at our offices?\nadidas Careers\nCheck out these videos to see what it’s like to work in our\noffices around the world!\nTHROUGH SPORT, WE HAVE THE POWER TO CHANGE LIVES\nwww.careers.adidas-group.com","description_format":"text","description_chars":11072,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Hybrid work"],"hiring_locations":[{"name":"Spain","iso":"ES","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-09T08:23:04Z"}],"visa":[],"liveness":{"score":19,"band":"cold","label":"Long shot","p_open":1,"p_active":0.534,"p_room":0.35,"age_days":9,"expected_fill_days":4,"reasons":["conf:2","velocity","win:tail","comp:brand"],"computed_at":"2026-10-19T05:45:15Z"},"pay":null,"html_url":"https://alion.io/job/adidas-third-party-cybersecurity-risk-management","json_url":"https://alion.io/job/adidas-third-party-cybersecurity-risk-management.json","meta":{"generated_at":"2026-10-19T22:49:15Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1769,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":40940},"rest":"https://alion.io/mcp/rest/get_company?id=40940"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fadidas-third-party-cybersecurity-risk-management"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fadidas-third-party-cybersecurity-risk-management"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fadidas-third-party-cybersecurity-risk-management"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/adidas-third-party-cybersecurity-risk-management\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fadidas-third-party-cybersecurity-risk-management"}]}