Senior Third-Party Risk Management Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Manage Momentive's global inventory of third-party providers, applications, and services from onboarding to termination.

• Conduct vendor cybersecurity evaluations and collaborate with Cybersecurity Engineering, Legal, and business stakeholders.

• Evaluate vendor maturity utilizing frameworks such as NIST CSF, CIS, CMMC, GDPR, PCI DSS, SOC 2, and others.

• Monitor vendor SLAs, RPO/RTO commitments, breach notification protocols, and cybersecurity insurance documentation.

• Record findings, suggestions, and remediation strategies for vendor evaluations.

• Engage with internal and external auditors concerning vendor-related controls and evidence gathering.

• Supply evidence, documentation, and control verification for SOC 2 Type II and PCI DSS evaluations.

• Ensure vendor controls are in alignment with Momentive's ISMS, contractual obligations, and certification standards.

• Keep audit-ready policies, standards, procedures, and risk treatment plans updated.

• Monitor vendor exceptions and compensating controls.

• Assist in communicating vulnerability notifications to clients managing their own cybersecurity controls.

• Offer consultative advice on risk implications, remediation expectations, and suggested cybersecurity practices.

• Maintain documentation and metrics related to client notifications, follow-up actions, and resolutions.

• Contribute to the continuous enhancement of Momentive's ISMS and cybersecurity measures.

• Assist in DR/BCP planning associated with vendor dependencies and resilience requirements.

• Collaborate with Legal, Cybersecurity, and leadership to strategize on vendor-related risk mitigation.

• Foster a cybersecurity culture across the enterprise through outreach, training, and awareness initiatives.

• Provide support to both internal and external stakeholders.

• Mentor team members and aid in developing internal training materials and documentation.

⛳️ Requirements

• Over 5 years of experience in cybersecurity, risk management, audit, or compliance.

• Comprehensive understanding of regulatory standards such as PCI DSS, SOC 2, GDPR, GLBA, HIPAA, SOX, and HITRUST.

• Experience in evaluating both legacy and contemporary cloud technologies (AWS, GCP, Azure).

• Profound knowledge of APIs, application cybersecurity, encryption, endpoint, and network security concepts.

• Familiarity with SIEM, IDS, log management, vulnerability management, and threat intelligence.

• Capability to assess vendor controls, align them with frameworks, and communicate risks to non-technical audiences.

• Strong project management, multitasking, and organizational capabilities.

• Exceptional written and verbal communication skills.

• Experience in supporting SOC 2 Type II and PCI DSS audits.

• Proficiency with EGRC/ITGRC platforms (e.g., Jira Service Manager GRC, Archer, OneTrust, LogicGate).

• Relevant certifications such as CISSP, CISM, CISA, CRISC, CTPRA, or CTPRP.

• Eligibility to work in the United States without the need for sponsorship.

• Must be at least 18 years old.

🏝️ Benefits

• Medical, Dental & Vision Benefits.

• 401(k) Savings Plan with Company Match.

• Flexible Planned Paid Time Off.

• Generous Sick Leave.

• Inclusive & Welcoming Environment.

• Purpose-Driven Culture.

• Work-Life Balance.

• Commitment to Community Involvement.

• Employer-Paid Parental Leave.

• Employer-Paid Short-Term Disability.

• Remote Work Flexibility.