- Employment
- Full-Time
- Seniority
- Senior
- Department
- Legal & Compliance
- Industry
- Fashion, Apparel & Leather Goods
- Posted
- Sep 23, 2026
About PVH
PVH is a global fashion group with a distinguished heritage, best known for shaping iconic brands such as Calvin Klein and Tommy Hilfiger. As an employer, PVH offers a dynamic, international environment where creativity, commercial excellence, and responsible growth converge. The company values collaboration, inclusion, and forward-thinking talent, encouraging teams to challenge convention while honoring the cultural relevance of its brands. With opportunities spanning design, merchandising, retail, digital, supply chain, and corporate functions, PVH provides employees with the scale of a global enterprise and the energy of a brand-led organization committed to innovation, sustainability, and enduring consumer connection.
PVH seeks a Senior Analyst for Vendor Risk & Cybersecurity Policy Management to lead third-party cyber risk assessments and maintain the enterprise information security policy framework. The role partners with procurement, legal, privacy, and technology stakeholders to evaluate vendor cybersecurity posture, track remediation activities, manage policy compliance, and deliver governance reporting aligned with NIST CSF, ISO 27001, and regulatory requirements. This position requires EST time zone availability.
Role & Responsibilities
- Conduct cybersecurity risk assessments for prospective and existing third-party vendors, reviewing SOC reports, ISO certifications, penetration test summaries, and disaster recovery documentation
- Evaluate vendor security posture, identify potential risks, document findings, and provide risk ratings with remediation recommendations
- Partner with Procurement, Legal, Privacy, Compliance, and business stakeholders throughout vendor onboarding and renewal processes
- Track remediation activities and monitor outstanding vendor risks through closure; support periodic reassessments of critical suppliers
- Maintain third-party risk metrics and dashboards for management reporting
- Maintain the enterprise cybersecurity policy, standards, and supporting guideline library; coordinate scheduled reviews and updates with policy owners
- Ensure policies align with NIST CSF, ISO 27001, CIS Controls, PCI-DSS, SOX, GDPR, and applicable regulatory and privacy requirements
- Track policy exceptions and support the risk acceptance process; manage policy publication, version control, approvals, and communications
- Prepare dashboards and reporting on vendor assessments, remediation actions, policy compliance, exceptions, and third-party risk trends
- Support risk committees and governance meetings through preparation of reports and presentations; maintain audit and regulatory documentation
- Identify opportunities to improve vendor assessment and policy management processes through automation and workflow optimization
- Stay informed of emerging cybersecurity threats, regulatory changes, and industry best practices
Qualifications
- Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Risk Management, or related discipline (or equivalent experience)
- 2–5 years of experience in cybersecurity, IT risk, governance, compliance, or vendor risk management
- Understanding of third-party risk management, cybersecurity fundamentals, information security governance, and risk assessment methodologies
- Familiarity with NIST CSF, ISO 27001, and CIS Controls
- Experience reviewing SOC reports, ISO certifications, and security questionnaires
- Strong analytical, documentation, communication, and organizational skills
- Risk Analysis, Critical Thinking, Written Communication, Stakeholder Management, Attention to Detail, Problem Solving, Collaboration, Business Acumen, Process Improvement, and Continuous Learning
Skills
Experience
2–5 years of professional experience in cybersecurity, IT risk, governance, compliance, or vendor risk management. Demonstrated experience reviewing SOC reports, ISO certifications, security questionnaires, and conducting third-party risk assessments. Preferred experience with GRC platforms (ProcessUnity, AuditBoard, ServiceNow), maintaining information security policies and standards, and supporting SOX, PCI DSS, or ISO audits.
Education
Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Risk Management, or related discipline, or equivalent professional experience demonstrating mastery of core cybersecurity and risk management concepts.
Culture
PVH fosters a dynamic, inclusive workplace where associates are encouraged to bring their authentic selves while shaping some of the world’s most recognized fashion brands. The company emphasizes collaboration, innovation, and accountability, offering a global environment that supports career growth and responsible business practices.
About Cerulean
Cerulean is the definitive career portal for the global luxury industry. We match exceptional professionals with exclusive opportunities at the world's most prestigious brands. From haute couture and fine watchmaking to prestige beauty, hospitality, and boutique retail, Cerulean centralises luxury employment to help you find the career for which you were destined.
Frequently Asked Questions
The luxury industry is characterised by a diverse and nuanced nomenclature. Esteemed houses frequently employ proprietary terminology, and even within a single organisation like PVH, titles may vary across global markets to reflect local conventions. To ensure absolute clarity, Cerulean assigns a standardised, industry-coherent canonical title to every listing. However, it is worth noting that this role is functionally synonymous with «Cybersecurity Risk Analyst», «Vendor Risk Manager», «Information Security Policy Analyst», «Third-Party Risk Specialist», and other variations. Our sophisticated search architecture anticipates these variations, ensuring that inquiries using related terms will seamlessly yield the exact roles you desire.