Third-Party Risk Management Analyst

Job Summary

Owning the security risk assessments for critical vendors and partners, the remote Third-Party Risk Management Analyst will manage the complete lifecycle of vendor relationships, ensuring compliance with security standards while collaborating with Legal and Procurement teams.

Key responsibilities

• Lead end-to-end third-party security risk assessments and recommend risk ratings in line with the Vendor Risk Management Policy
• Oversee vendor reassessment cadence and track remediation of security gaps throughout the vendor lifecycle
• Partner with Legal and Procurement to review vendor contracts and ensure security requirements are met prior to vendor onboarding

Required qualifications

• 5+ years of experience in third-party/vendor risk management, GRC, or information security compliance
• Experience using automation, scripting, or low-code workflows to scale a vendor risk program
• Hands-on experience running vendor security assessments and managing a vendor tiering program
• Experience collaborating with Legal and Procurement on vendor contract security and privacy terms
• Must reside in the US, outside the San Francisco Bay Area, New York City, and Washington, D.C. metro areas