Security Analyst, Third-Party Ecosystem Risk Management
Summary
Run third-party security risk assessments, vet customers and partners, maintain risk registers, and build AI-assisted workflows for security documentation review and reporting.
You will run third-party security risk assessments from intake through risk rating and remediation, assess customers and partners, maintain risk tiering and the risk register, mature questionnaires and workflows, report on ecosystem risk, and build AI-assisted assessment and reporting workflows.
Responsibilities
- Run vendor security risk assessments
- Review vendor questionnaires, SOC 2 reports, ISO reports, and security documentation
- Rate risk and document findings and exceptions
- Vet customer and partner security posture
- Maintain risk tiering and reassessment cadence
- Track remediation to closure
- Maintain the risk register
- Improve questionnaires, tiering criteria, intake, runbooks, and tooling
- Report on ecosystem risk and program health
- Build AI-assisted workflows for assessment review, questionnaire analysis, and reporting
Requirements
- 4+ years of vendor risk management experience
- Third-party security risk assessment experience
- Vendor security risk assessment experience
- SOC 2 knowledge
- ISO 27001 knowledge
- NIST CSF knowledge
- Access control knowledge
- Encryption knowledge
- Incident response knowledge
- Business continuity and disaster recovery knowledge
- Third-party risk lifecycle knowledge
- Third-party risk program maturation experience
- Assessment execution at volume
- Analytical skills
- Documentation skills
- Written communication skills
- Verbal communication skills
- AI tooling experience
- CTPRP, CISA, or CISSP credential
- TPRM platform experience
Benefits
- Equity
- Medical insurance
- Dental insurance
- Vision insurance
- 401(k)