Senior Third-Party Risk Analyst

Top 3 Skills

Third-Party Risk Management (TPRM) - hands-on vendor assessment lifecycle from intake through remediation
Security framework fluency - SOC 2, ISO 27001, NIST CSF, FedRAMP, PCI DSS
Risk communication - ability to translate complex findings for both technical teams and executive stakeholders

What You'll Do

Lead end-to-end risk assessments for new and existing vendors, covering cybersecurity posture and regulatory compliance
Review vendor-submitted security questionnaires, SOC 2 reports, ISO certifications, and audit documentation
Coordinate directly with vendors to validate security controls and drive remediation timelines
Classify vendors into risk tiers and maintain a live vendor risk database
Partner with Procurement, Legal, Privacy, and InfoSec on contract reviews and supplier security standards
Monitor ongoing supplier risk profiles and flag changes that require escalation
Identify automation opportunities within the assessment workflow to reduce manual overhead
Contribute to broader InfoSec risk initiatives beyond the vendor program

What We Need From You

6+ years in third-party risk assessment, vendor governance, or information security risk management
Working knowledge of ISO 27001/2, SOC 2, NIST CSF, FedRAMP, and PCI DSS
Experience managing multiple concurrent vendor assessments without dropping the ball
Strong written and verbal communication - you can brief a CISO and a procurement manager in the same day
Bachelor's degree in Cybersecurity, Information Security, Risk Management, Computer Science, or a related field

Bonus If You Have

A Few Things to Know

You'll be expected to build cross-functional relationships across multiple internal teams
This role sits within a dedicated TPRM function - you won't be context-switching into unrelated IT work

Sr Third-Party Risk Analyst

Quick Overview