Third-Party Security Risk Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Assist in the onboarding and reassessment of third-party vendors within the Security framework.

• Collect information, document risks, facilitate discussions among stakeholders, evaluate inherent and residual risks, and monitor follow-up actions and remediation efforts.

• Conduct initial impact assessments and categorize vendor risk tiers based on data classification, system access, operational criticality, and regulatory exposure.

• Execute standardized third-party risk assessments, which include reviewing security questionnaires, SOC reports, and supporting documentation.

• Monitor assessment progress and coordinate with risk domain owners for necessary follow-ups.

• Record risk findings, ratings, and scores for both inherent and residual risks.

• Supervise open findings and commitments for remediation, escalating any overdue items as needed.

• Assist in ensuring vendor contracts contain the necessary Infosec addendum clauses.

• Maintain procedures, templates, and guidelines for the Third-Party Risk Management (TPRM) program.

• Aid in internal and external audits by preparing necessary documentation and responding to inquiries.

• Support enhancements in the vendor risk program through AI-enabled automation improvements.

• Assess the use of AI in vendor products and services, focusing on data protection, model and platform risks, and compliance with contractual and regulatory standards.

• Implement the complete TPRM lifecycle, from initial vendor evaluations to continuous monitoring and offboarding.

• Collaborate with Legal, Procurement, Compliance, ERM, Finance, Risk, and business stakeholders.

⛳️ Requirements

• Relevant experience in third-party risk management, vendor management, procurement, information security, compliance, or audit (internships are applicable).

• Fundamental understanding of third-party risk principles, governance policies, and prevalent security frameworks (e.g., HITRUST, NIST CSF, ISO 27001, ISO 42001, SOC 2).

• Exposure to vendor lifecycle processes, including onboarding, continuous monitoring, and offboarding.

• Experience with reviewing contract clauses related to security, privacy, and business resilience controls.

• Familiarity with tracking findings or vulnerability remediation.

• Awareness of supply chain risks associated with software and hardware.

• Strong analytical capabilities to interpret data and identify gaps or inconsistencies in vendor responses.

• Excellent organizational skills and attention to detail, capable of managing multiple assessments simultaneously.

• Strong written and verbal communication abilities.

• Comfort in collaborating cross-functionally with Legal, Finance, Risk, Procurement, and business stakeholders.

• Bachelor's degree in risk management, information security, privacy, compliance, business, or a related field (preferred).

• 3-5 years of experience in a third-party risk management capacity, including vendor management (preferred).

• Familiarity with cloud security protocols and shared responsibility models across AWS, Azure, and GCP.

• Understanding of AI-related risks and controls, including data usage and retention, model transparency, responsible AI practices, NIST AI Risk Management Framework, or ISO/IEC 42001.

• Knowledge of healthcare regulations such as HIPAA and HITRUST.

• Relevant certifications or progress towards them, such as CISA or CIA (preferred).

🏝️ Benefits

• Employer-sponsored health, dental, and vision plans with minimal or no premium costs.

• Generous paid time off policy.

• Monthly stipend of $100 for mobile or internet expenses.

• Stock options available to all employees.

• Bonus eligibility for all positions except for Director and above roles.

• Comprehensive parental leave program.

• 401K program participation.

• Total rewards package for full-time employees.