Third-Party Risk Analyst

Job Summary

Supporting the Third-Party Risk Management program, the full-time remote Third-Party Security Risk Analyst will assess vendor risks, document findings, and facilitate stakeholder discussions to ensure secure partnerships.

Key responsibilities

• Perform initial impact assessments and assign risk tiers to vendors based on established criteria
• Conduct standardized third-party risk assessments and track assessment status with risk domain owners
• Document risk findings and monitor remediation commitments, escalating overdue items as necessary

Required qualifications

• Practical experience in third-party risk management, vendor management, or information security
• Basic understanding of third-party risk concepts and common security frameworks (e.g., HITRUST, NIST CSF)
• Exposure to vendor lifecycle procedures, including onboarding and ongoing monitoring
• Familiarity with contract clause reviews related to security and privacy controls
• Strong analytical skills with the ability to interpret data and identify inconsistencies in vendor responses