Third-Party Security Risk Analyst

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Third-Party Security Risk Analyst based in the United States.

The Third-Party Security Risk Analyst will play an important role in strengthening cybersecurity governance and protecting the organization through effective third-party risk management. Working within the Cybersecurity Governance, Risk Management, and Compliance (GRC) team, you will support the full vendor risk lifecycle, from initial onboarding and risk assessments to ongoing monitoring and offboarding. You will evaluate vendor security practices, identify potential vulnerabilities, document risk exposure, and coordinate remediation efforts. The role also involves collaborating with cross-functional teams, including Legal, Procurement, Compliance, Finance, and Enterprise Risk Management. You will contribute to improving risk management processes through automation and emerging AI-enabled solutions. This is an excellent opportunity to develop your cybersecurity expertise while helping build a resilient and secure third-party ecosystem.

Accountabilities:

Support the onboarding, reassessment, ongoing monitoring, and offboarding of third-party vendors, ensuring compliance with established security requirements.
Conduct initial vendor impact assessments and assign appropriate risk tiers based on data sensitivity, system access, operational criticality, and regulatory exposure.
Perform standardized third-party security risk assessments by reviewing security questionnaires, SOC reports, and other supporting documentation under the guidance of senior team members.
Evaluate inherent and residual risks, document findings and risk ratings, and ensure assessment records are accurate and consistent.
Coordinate with internal stakeholders and risk domain owners to track assessment progress, obtain outstanding documentation, and meet deadlines.
Monitor vendor security findings, remediation plans, and outstanding commitments, escalating overdue actions when necessary.
Support contract reviews by verifying that required information security and risk-related clauses are included in vendor agreements.
Maintain and improve TPRM policies, procedures, templates, and guidelines to ensure consistent and repeatable processes.
Assist with internal and external audits by preparing supporting documentation and responding to evidence requests.
Contribute to the implementation of AI-enabled automation initiatives designed to improve the efficiency of vendor risk management activities.
Assess emerging AI-related risks associated with third-party products and services, including data protection, model security, platform risks, and compliance with contractual and regulatory requirements.
Requirements:
Practical experience in third-party risk management, vendor management, procurement, information security, compliance, or auditing. Relevant internships and early-career experience are also considered.
Basic understanding of third-party risk management principles, governance policies, and recognized security frameworks, such as HITRUST, NIST Cybersecurity Framework, ISO 27001, ISO 42001, and SOC 2.
Familiarity with vendor lifecycle management processes, including onboarding, ongoing monitoring, reassessment, and offboarding.
Exposure to reviewing contractual requirements related to information security, data privacy, and business resilience.
Understanding of security findings, vulnerability management, and remediation tracking processes.
Awareness of software and hardware supply chain security risks.
Strong analytical skills, with the ability to interpret information, evaluate vendor responses, and identify inconsistencies or potential security gaps.
Excellent organizational skills and attention to detail, with the ability to manage multiple assessments and deadlines simultaneously.
Strong written and verbal communication skills, including the ability to document findings clearly and collaborate effectively with different stakeholders.
Ability to work cross-functionally with Legal, Finance, Risk, Procurement, Compliance, and business teams.
A bachelor's degree in Risk Management, Information Security, Privacy, Compliance, Business, or a related field is preferred.
Ideally, 3–5 years of experience in third-party risk management or vendor management.
Familiarity with cloud security controls and shared responsibility models across major cloud providers, including AWS, Azure, and Google Cloud Platform.
Awareness of AI-related security and governance risks, including data usage and retention, model transparency, and responsible AI practices, as well as emerging standards such as the NIST AI Risk Management Framework and ISO/IEC 42001.
Knowledge of healthcare security and privacy regulations, particularly HIPAA and HITRUST, is an advantage.
Relevant professional certifications, or progress toward obtaining them, such as CISA or CIA, are desirable.
Benefits:
Competitive annual salary: $58,000–$110,000, depending on experience, qualifications, certifications, skills, and work location.
Employer-sponsored health, dental, and vision insurance plans, with low or no employee premiums.
Generous paid time off.
Monthly $100 mobile phone or internet stipend.
Stock options available to all employees.
Bonus eligibility for most roles, excluding Director-level positions and above.
Commission eligibility for Sales positions.
Parental leave program.
401(k) retirement savings program.
Additional benefits and rewards as part of the comprehensive employee package.