About Us:
We are brand builders who focus our passion and creativity to build Calvin Klein and TOMMY HILFIGER into the most desirable lifestyle brands in the world and at the same time position PVH as one of the best-performing brand groups in our sector. Guided by our values and enabled by our scale and global reach, we are driving fashion forward for good, as one team with one vision and one plan. That’s the Power of Us, that’s the Power of PVH+.
One of PVH’s greatest strengths is our people. Our collective desire is to create a workplace environment where every individual is valued, and every voice is heard, and we are committed to fostering an inclusive and diverse community of associates with a strong sense of belonging. Learn more about Inclusion & Diversity at PVH here .
Position Summary
The Senior Analyst, Vendor Risk & Cybersecurity Policy Management is responsible for supporting the organization's third-party cyber risk management program and maintaining the enterprise information security policy and standards framework. This role partners with business stakeholders, procurement, legal, privacy, and technology teams to evaluate cybersecurity risks associated with third parties while ensuring internal security policies and standards remain current, effective, and aligned with business objectives, regulatory requirements, and industry best practices.
The ideal candidate is analytical, organized, and capable of translating technical cybersecurity concepts into practical business guidance.
This position requires to work in EST time Zone.
Key Responsibilities
Third-Party Cyber Risk Management
· Conduct cybersecurity risk assessments for prospective and existing third-party vendors.
· Review SOC 1/SOC 2 reports, ISO 27001 certifications, penetration test summaries, security questionnaires, and business continuity/disaster recovery documentation.
· Evaluate vendor security posture and identify potential risks.
· Document assessment findings and provide risk ratings and remediation recommendations.
· Partner with Procurement, Legal, Privacy, Compliance, and business stakeholders throughout vendor onboarding and renewal processes.
· Track remediation activities and monitor outstanding vendor risks through closure.
· Support periodic reassessments of critical suppliers.
· Maintain third-party risk metrics and dashboards for management reporting.
Cyber Policy & Standards Management
· Maintain the enterprise cybersecurity policy, standards, and supporting guideline library.
· Coordinate scheduled reviews and updates with policy owners and subject matter experts.
· Ensure policies align with NIST CSF, ISO 27001, CIS Controls, PCI-DSS, SOX, GDPR and applicable regulatory/privacy requirements.
· Track policy exceptions and support the risk acceptance process.
· Support policy publication, version control, approvals, and communication activities.
· Assist with development of new cybersecurity standards supporting emerging technologies and business initiatives.
· Support internal and external audits related to cybersecurity governance.
Governance & Reporting
· Prepare dashboards and reporting on vendor assessments, remediation actions, policy review compliance, policy exceptions, and third-party risk trends.
· Support risk committees and governance meetings through preparation of reports and presentations.
· Maintain documentation supporting audit and regulatory inquiries.
Continuous Improvement
· Identify opportunities to improve vendor assessment processes through automation and workflow optimization.
· Recommend enhancements to policy lifecycle management processes.
· Stay informed of emerging cybersecurity threats, regulatory changes, and industry best practices.
· Support implementation and enhancement of Governance, Risk, and Compliance (GRC) technologies.
Qualifications
Required
· Bachelor's…