Third Party Risk Management Jobs in USA with Visa Sponsorship
Third Party Risk Management roles are regularly sponsored under the H-1B visa, as the work qualifies as a specialty occupation requiring a bachelor's degree or higher in finance, business, information systems, or a related field. Employers across banking, consulting, and fintech actively file LCAs for these positions. For detailed occupation requirements, see the O*NET profile.
Find Third Party Risk Management JobsOverview
Showing 5 of 7,281+ Third Party Risk Management jobs
See all 7,281+ Third Party Risk Management Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Third Party Risk Management roles.
Get Access To All JobsWe’re building a world of health around every individual — shaping a more connected, convenient and compassionate health experience. At CVS Health®, you’ll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger – helping to simplify health care one person, one family and one community at a time.
Position Summary
The Lead Director of Third-Party Security Assessment & Risk Operations plays a critical role in protecting the organization by ensuring that third parties (vendors, suppliers, and partners) meet the security standards required to operate in a highly regulated environment. This role leads the end-to-end lifecycle of third-party security assessments, ensuring that risks are identified early, understood clearly, and addressed effectively. By building and advancing a scalable, risk-based assessment program, this position helps safeguard the enterprise while enabling the business to move forward with confidence in its external partnerships.
This leader partners closely with Procurement, Legal, Compliance, and business units to embed security into the full vendor lifecycle and translate complex cyber risks into clear, actionable guidance. The role also shapes enterprise-wide risk and control assurance efforts by bringing visibility, consistency, and accountability to third-party risk management. Through strong program leadership, executive engagement, and continuous improvement, the Lead Director ensures the organization can manage third-party risk at scale while supporting growth, regulatory compliance, and operational resilience.
Key Responsibilities:
Third Party Security Leadership
- Own and continuously mature the enterprise Third Party Security program, including processes, and tooling.
- Direct staff in the identification, development, implementation, and maintenance of security assessment practices for all third parties — including vendors, suppliers, and business partners.
- Establish demand-driven resource models and align team capacity to portfolio volume and organizational priorities.
- Build, coach, and lead a high-performing team of security professionals spanning Individual Contributors, Managers, and Senior Managers.
Risk Assessment & Control Assurance
- Lead the evaluation and assessment of emerging cyber threats, vulnerabilities, and attack vectors relevant to third party ecosystems.
- Direct detailed control testing, regulatory audit scenarios, and compliance validation activities for third party relationships.
- Develop and enforce risk-based remediation strategies derived from assessment findings and lessons learned.
- Implement and enforce security controls within third parties supporting large, complex, and diverse enterprise environments.
Regulatory Compliance & Policy Alignment
- Ensure organizational adherence to applicable local, national, and international regulatory requirements (e.g., HIPAA, PCI-DSS, NIST, ISO 27001/27036, SOC 2) within the scope of third party security.
- Provide authoritative security guidance to project teams, portfolio personnel, and business leaders to ensure alignment with CVS Health control standards.
- Monitor evolving regulatory and industry landscapes and proactively adjust program requirements to maintain compliance.
Executive Stakeholder Engagement
- Serve as a trusted advisor to senior business and technology executives on third party cyber security matters.
- Communicate risk posture, program performance metrics, and remediation status to executive leadership through compelling, data-driven presentations.
- Act as the primary point of enablement for Third Party Security Assessment Operations across the organization.
- Develop and sustain strategic relationships across functional business, IT, and vendor leadership teams.
Operational Excellence & Continuous Improvement
- Establish organizational capabilities to track program progress, surface issues, and remove obstacles in alignment with the CVS Health mission.
- Define and monitor KPIs and KRIs to measure program effectiveness and drive continuous improvement.
- Identify and implement technology solutions and automation opportunities to scale assessment operations.
Required Qualifications
- 10+ years of progressive Information Security experience, with a strong foundation across risk management, architecture, and engineering domains.
- 7+ years of direct leadership experience managing security professionals in both direct and matrixed reporting structures.
- 5+ years of experience building and leading Third Party Security Risk or Vendor Risk Management programs at enterprise scale.
- 5+ years of experience leading detailed control testing, regulatory audits, and compliance assessments.
- 3+ years of experience implementing security controls within third party environments supporting large, complex enterprises.
Preferred Qualifications
- Exceptional communication and executive presentation skills; ability to translate technical risk into business language for non-technical audiences.
- Strong command of risk analysis frameworks and the ability to derive well-defined mitigation strategies from assessment findings.
- Demonstrated ability to lead and influence without direct authority across cross-functional, matrixed organizations.
- Superior organizational and process management skills; experience building and scaling high-performing teams.
- Proficiency with Third Party Risk platforms (e.g., Archer, SecurityScorecard, ServiceNow, BlackKite) and GRC tooling.
- Integration and adoption of AI-based tooling to facilitate time to market and defensible results.
Education
- Bachelor’s degree or equivalent experience (High School Diploma and 4 years relevant experience).
Pay Range
The typical pay range for this role is:
$144,200.00 - $288,400.00
This pay range represents the base hourly rate or base annual full-time salary for all positions in the job grade within which this position falls. The actual base salary offer will depend on a variety of factors including experience, education, geography and other relevant factors. This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above. This position also includes an award target in the company’s equity award program.
Our people fuel our future. Our teams reflect the customers, patients, members and communities we serve and we are committed to fostering a workplace where every colleague feels valued and that they belong.
Great benefits for great people
We take pride in offering a comprehensive and competitive mix of pay and benefits that reflects our commitment to our colleagues and their families.
This full‑time position is eligible for a comprehensive benefits package designed to support the physical, emotional, and financial well‑being of colleagues and their families. The benefits for this position include medical, dental, and vision coverage, paid time off, retirement savings options, wellness programs, and other resources, based on eligibility.
Additional details about available benefits are provided during the application process and on Benefits Moments.
We anticipate the application window for this opening will close on: 07/06/2026
Qualified applicants with arrest or conviction records will be considered for employment in accordance with all federal, state and local laws.
We’re building a world of health around every individual — shaping a more connected, convenient and compassionate health experience. At CVS Health®, you’ll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger – helping to simplify health care one person, one family and one community at a time.
Position Summary
The Lead Director of Third-Party Security Assessment & Risk Operations plays a critical role in protecting the organization by ensuring that third parties (vendors, suppliers, and partners) meet the security standards required to operate in a highly regulated environment. This role leads the end-to-end lifecycle of third-party security assessments, ensuring that risks are identified early, understood clearly, and addressed effectively. By building and advancing a scalable, risk-based assessment program, this position helps safeguard the enterprise while enabling the business to move forward with confidence in its external partnerships.
This leader partners closely with Procurement, Legal, Compliance, and business units to embed security into the full vendor lifecycle and translate complex cyber risks into clear, actionable guidance. The role also shapes enterprise-wide risk and control assurance efforts by bringing visibility, consistency, and accountability to third-party risk management. Through strong program leadership, executive engagement, and continuous improvement, the Lead Director ensures the organization can manage third-party risk at scale while supporting growth, regulatory compliance, and operational resilience.
Key Responsibilities:
Third Party Security Leadership
- Own and continuously mature the enterprise Third Party Security program, including processes, and tooling.
- Direct staff in the identification, development, implementation, and maintenance of security assessment practices for all third parties — including vendors, suppliers, and business partners.
- Establish demand-driven resource models and align team capacity to portfolio volume and organizational priorities.
- Build, coach, and lead a high-performing team of security professionals spanning Individual Contributors, Managers, and Senior Managers.
Risk Assessment & Control Assurance
- Lead the evaluation and assessment of emerging cyber threats, vulnerabilities, and attack vectors relevant to third party ecosystems.
- Direct detailed control testing, regulatory audit scenarios, and compliance validation activities for third party relationships.
- Develop and enforce risk-based remediation strategies derived from assessment findings and lessons learned.
- Implement and enforce security controls within third parties supporting large, complex, and diverse enterprise environments.
Regulatory Compliance & Policy Alignment
- Ensure organizational adherence to applicable local, national, and international regulatory requirements (e.g., HIPAA, PCI-DSS, NIST, ISO 27001/27036, SOC 2) within the scope of third party security.
- Provide authoritative security guidance to project teams, portfolio personnel, and business leaders to ensure alignment with CVS Health control standards.
- Monitor evolving regulatory and industry landscapes and proactively adjust program requirements to maintain compliance.
Executive Stakeholder Engagement
- Serve as a trusted advisor to senior business and technology executives on third party cyber security matters.
- Communicate risk posture, program performance metrics, and remediation status to executive leadership through compelling, data-driven presentations.
- Act as the primary point of enablement for Third Party Security Assessment Operations across the organization.
- Develop and sustain strategic relationships across functional business, IT, and vendor leadership teams.
Operational Excellence & Continuous Improvement
- Establish organizational capabilities to track program progress, surface issues, and remove obstacles in alignment with the CVS Health mission.
- Define and monitor KPIs and KRIs to measure program effectiveness and drive continuous improvement.
- Identify and implement technology solutions and automation opportunities to scale assessment operations.
Required Qualifications
- 10+ years of progressive Information Security experience, with a strong foundation across risk management, architecture, and engineering domains.
- 7+ years of direct leadership experience managing security professionals in both direct and matrixed reporting structures.
- 5+ years of experience building and leading Third Party Security Risk or Vendor Risk Management programs at enterprise scale.
- 5+ years of experience leading detailed control testing, regulatory audits, and compliance assessments.
- 3+ years of experience implementing security controls within third party environments supporting large, complex enterprises.
Preferred Qualifications
- Exceptional communication and executive presentation skills; ability to translate technical risk into business language for non-technical audiences.
- Strong command of risk analysis frameworks and the ability to derive well-defined mitigation strategies from assessment findings.
- Demonstrated ability to lead and influence without direct authority across cross-functional, matrixed organizations.
- Superior organizational and process management skills; experience building and scaling high-performing teams.
- Proficiency with Third Party Risk platforms (e.g., Archer, SecurityScorecard, ServiceNow, BlackKite) and GRC tooling.
- Integration and adoption of AI-based tooling to facilitate time to market and defensible results.
Education
- Bachelor’s degree or equivalent experience (High School Diploma and 4 years relevant experience).
Pay Range
The typical pay range for this role is:
$144,200.00 - $288,400.00
This pay range represents the base hourly rate or base annual full-time salary for all positions in the job grade within which this position falls. The actual base salary offer will depend on a variety of factors including experience, education, geography and other relevant factors. This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above. This position also includes an award target in the company’s equity award program.
Our people fuel our future. Our teams reflect the customers, patients, members and communities we serve and we are committed to fostering a workplace where every colleague feels valued and that they belong.
Great benefits for great people
We take pride in offering a comprehensive and competitive mix of pay and benefits that reflects our commitment to our colleagues and their families.
This full‑time position is eligible for a comprehensive benefits package designed to support the physical, emotional, and financial well‑being of colleagues and their families. The benefits for this position include medical, dental, and vision coverage, paid time off, retirement savings options, wellness programs, and other resources, based on eligibility.
Additional details about available benefits are provided during the application process and on Benefits Moments.
We anticipate the application window for this opening will close on: 07/06/2026
Qualified applicants with arrest or conviction records will be considered for employment in accordance with all federal, state and local laws.
See all 7,281+ Third Party Risk Management Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Third Party Risk Management roles.
Get Access To All JobsTips for Finding Third Party Risk Management Jobs
Target financial institutions and Big Four consulting firms
Banks, insurance companies, and consulting firms such as Deloitte and PwC are among the most active H-1B sponsors for risk management roles. Their compliance-heavy operations create consistent demand for qualified candidates who need visa support.
Align your degree to the role explicitly
USCIS requires a specific degree field for specialty occupation approval. A degree in finance, information systems, business administration, or risk management strengthens your case considerably. Generic business degrees without a risk-relevant concentration can draw additional scrutiny.
Highlight vendor risk frameworks in your application
Employers sponsoring this role want candidates with hands-on experience in frameworks like NIST, ISO 27001, or SOC 2. Naming these in your resume signals that you can deliver immediately, which makes the sponsorship investment easier for hiring managers to justify.
Pursue roles with regulatory compliance components
Positions tied to OCC, FFIEC, or DORA compliance carry stronger specialty occupation arguments for USCIS. Roles that require interpreting regulation and applying professional judgment are better positioned for H-1B approval than generalist vendor management jobs.
Ask about cap-exempt employers during your search
Universities, nonprofit research institutions, and certain government-affiliated entities are exempt from the H-1B lottery. Third Party Risk Management roles exist at these organizations, and a cap-exempt filing means you can start without waiting for an April selection cycle.
Use Migrate Mate to filter for verified sponsoring employers
Not every company willing to hire will sponsor a visa. Migrate Mate surfaces roles from employers with a documented sponsorship history, saving you the time of applying to positions where the conversation will stall before it starts.
Frequently Asked Questions
Does Third Party Risk Management qualify as an H-1B specialty occupation?
Yes, in most cases. USCIS evaluates whether the role normally requires a bachelor's degree or higher in a specific field. Third Party Risk Management positions tied to financial regulation, cybersecurity risk, or vendor compliance programs typically clear this bar when the job description specifies a degree in finance, information systems, or a related discipline. Roles framed as general vendor coordination without a degree requirement are more vulnerable to a Request for Evidence.
Which visa types are available for Third Party Risk Management professionals?
The H-1B visa is the primary route for most nationalities. Australians can pursue the E-3 visa, which has no lottery and significantly shorter wait times. Canadians and Mexicans may qualify under the TN visa in the business or accountant categories, depending on the role's specific responsibilities. L-1B is an option if you're transferring within a multinational employer and can document specialized knowledge of the company's risk systems.
What degree does an employer typically require for a sponsored Third Party Risk Management role?
Most employers list a bachelor's degree in finance, business administration, information systems, accounting, or a related field as the minimum. Some cybersecurity-focused TPRM roles prefer computer science or information security degrees. If your degree is in a tangentially related field, a strong pattern of relevant certifications such as CRISC or CISA can help round out your profile, though the degree field remains the primary factor in USCIS's specialty occupation analysis.
How competitive is H-1B sponsorship for risk management roles compared to tech jobs?
Risk management roles face less H-1B lottery congestion than software engineering positions because fewer total petitions are filed in this category. However, the specialty occupation standard can be harder to satisfy if the job description is written loosely. The practical challenge is employer willingness: many risk and compliance hiring managers are unfamiliar with the sponsorship process. Migrate Mate filters for employers who have sponsored before, which removes that barrier from your search.
Can I transition into Third Party Risk Management from a different risk or compliance background while on a visa?
Yes, but the transition needs to be reflected in both your resume and the new job description. USCIS approves petitions based on the specific role being offered, not your general career trajectory. If you're moving from internal audit or information security into TPRM, the degree field and core duties should still overlap sufficiently to support a specialty occupation argument. Your employer's immigration attorney should review the job description before filing to confirm it's defensible.
What is the prevailing wage requirement for sponsored Third Party Risk Management jobs?
U.S. employers sponsoring a visa must pay at least the prevailing wage, which is what workers in the same role, area, and experience level typically earn. The Department of Labor sets this rate to make sure companies aren't hiring foreign workers simply because they'd accept lower pay than a U.S. worker. It varies by job title, location, and experience. You can look up current prevailing wage rates for any occupation and location using the OFLC Wage Search page.