Third-Party Risk Management Analyst IV

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee comprehensive third-party security risk assessments utilizing both qualitative and quantitative approaches.

• Propose vendor risk ratings and classifications in accordance with Samsara's Vendor Risk Management Policy.

• Manage the vendor reassessment schedule and monitor the resolution of security vulnerabilities throughout the vendor lifecycle.

• Collaborate with Legal, Procurement, and system/relationship owners regarding vendor contracts and onboarding requests submitted via Zip.

• Ensure that security prerequisites, including incident notification, data training, and compliance, are established before vendors commence operations.

• Raise any unresolved vendor risks to Security leadership, Legal, Procurement, and relevant business stakeholders.

• Assist in internal and external audits of the vendor risk program, including ISO, SOC, and FedRAMP audits.

• Develop and uphold metrics, dashboards, and reporting related to third-party risk status and program effectiveness.

• Facilitate automation and AI-driven tools within vendor risk processes.

• Provide mentorship to junior TPRM team members.

• Advocate for Samsara's cultural principles as the company expands globally and opens new offices.

⛳️ Requirements

• Minimum of 5 years of experience in third-party/vendor risk management, GRC, or information security compliance.

• Proficiency in leveraging automation, scripting, or low-code workflows to enhance a vendor risk program.

• Practical experience conducting vendor security assessments and managing a vendor tiering program.

• Experience collaborating with Legal and Procurement on security and privacy terms in vendor contracts, including security addendums and Data Processing Agreements (DPAs).

• Must be located in the US, excluding the San Francisco Bay Area, New York City, and Washington, D.C. metropolitan areas.

• Knowledge of NIST CSF, ISO 27001, or SOC 2 standards.

• Familiarity with a GRC or vendor risk management platform such as Vanta, ServiceNow, OneTrust, Archer, or similar tools.

• Relevant certifications such as CTPRP, CISA, CRISC, or CISSP are preferred.

🏝️ Benefits

• Initial RSU grant with no vesting cliff.

• Continuous equity refresh opportunities linked to performance.

• Performance-based bonus/variable pay.

• Above-market total compensation.

• Flexible, employee-led remote work model.

• Professional development stipend.

• Comprehensive health plans.

• Parental leave policies.

• Offices available for those who prefer in-person work.