Third Party Security Risk Analyst

Talenza; Sydney; Hybrid; AUD 120,000 - 180,000; Full time

Job summary

Talenza is seeking an experienced Third Party Risk Analyst to support its Federal Government client in Sydney. The role focuses on coordinating vendor risk assessments, reviewing security and privacy documentation, and monitoring third-party risks across the supplier lifecycle.

You will collaborate with procurement, security, legal and privacy teams to ensure compliance with PSPF/ISM, NIST and ISO 27001 standards, and you must have or be eligible for NV1 clearance.

Qualifications

• 5+ years in Third Party Risk Management or related fields.
• Experience with vendor risk assessments and due diligence.
• Knowledge of PSPF, ISM, Home Affairs FOCI guidance.
• Familiarity with NIST CSF and ISO 27001.
• Certifications such as CRISC, CISA, CompTIA Security+ are desirable.

Responsibilities

• Conduct third-party risk assessments across new procurements, contract renewals and existing supplier arrangements.
• Assess supplier risks relating to information security, privacy, operational resilience, AI and FOCI.
• Review supplier responses, supporting documentation, certifications, audit reports and security artefacts to identify risks and control gaps.
• Coordinate assessment activities from initiation through to completion, ensuring evidence and audit trails are maintained.
• Prepare risk assessment reports, findings summaries and recommendations for stakeholder review.
• Liaise with suppliers to obtain assessment responses and clarifications of risks.
• Administer vendor assessment questionnaires and support ongoing assessment workflows.
• Support vendor onboarding, classification and ongoing monitoring activities.
• Maintain vendor registers, assessment schedules, monitoring requirements and risk documentation.
• Monitor supplier security ratings, threat intelligence alerts and emerging risks, escalating material concerns.
• Facilitate stakeholder workshops and engagement activities for risk governance.
• Support supplier incident investigations and remediation activities.
• Contribute to ongoing improvement of third-party risk frameworks and governance artefacts.

Skills

Third Party Risk Management

Vendor risk assessments

Security and privacy governance

ISMS/PSPF awareness

Analytical/investigative skills

Stakeholder management

NV1 Clearance

Tools

NIST CSF

ISO 27001

NIST AI RMF

Job description

Our Federal Government client is seeking an experienced Third Party Risk Analyst to support the ongoing delivery and enhancement of its Third-Party Risk Management (TPRM) capability. This role will be responsible for coordinating and conducting supplier risk assessments, reviewing security and compliance documentation, managing vendor risk activities and supporting the ongoing monitoring of third-party risks across the supplier lifecycle. The successful candidate will work closely with procurement, security, legal, privacy and technology stakeholders to ensure suppliers meet governance, security and risk management requirements. Candidates must be Australian Citizens and be able to obtain a NV1 Clearance.

Role Title: Third Party Risk Analyst

Start Date: November 2026

Contract Role Till: 12 Month Initial Contract

Pay Rate: Market Rates

Location: Sydney CBD (2000), 50/50 split between office and work from home.

Hours of Work: 38 hours per week

Tasks & Responsibilities

• Conduct third-party risk assessments across new procurements, contract renewals and existing supplier arrangements.
• Assess supplier risks relating to information security, privacy, operational resilience, AI and foreign ownership, control or influence (FOCI).
• Review supplier responses, supporting documentation, certifications, audit reports and security artefacts to identify risks and control gaps.
• Coordinate assessment activities from initiation through to completion, ensuring appropriate evidence and audit trails are maintained.
• Prepare risk assessment reports, findings summaries and recommendations for stakeholder review.
• Liaise directly with suppliers to obtain assessment responses, supporting evidence and clarification of identified risks.
• Administer vendor assessment questionnaires and support ongoing assessment workflows.
• Support vendor onboarding, classification and ongoing monitoring activities.
• Maintain vendor registers, assessment schedules, monitoring requirements and risk documentation.
• Monitor supplier security ratings, threat intelligence alerts and emerging risks, escalating material concerns where required.
• Facilitate stakeholder workshops and engagement activities to support risk assessment and governance processes.
• Support supplier incident investigations, remediation activities and reassessment exercises as required.
• Contribute to the ongoing improvement of third-party risk frameworks, methodologies, processes and governance artefacts.

Experience & Skills Required

• 5+ years' experience within Third Party Risk Management, Technology Risk, IT Governance, Cyber Security, GRC or related disciplines.
• Experience conducting vendor security assessments, risk assessments or supplier due diligence activities.
• Strong understanding of Australian Government security requirements including PSPF, ISM, Home Affairs FOCI Guidance, APS AI Plan and DTA AI Policy.
• Familiarity with NIST Cyber Security Framework, NIST AI Risk Management Framework, ISO 27001 and related standards.
• Experience reviewing supplier security documentation, audit reports, certifications and assurance artefacts.
• Knowledge of Australian Government security requirements, including PSPF and ISM frameworks.
• Strong analytical and investigative skills with a high level of attention to detail.
• Experience preparing risk assessments, governance reports and executive-level documentation.
• Strong stakeholder management skills with the ability to work across technology, procurement, legal, privacy and business teams.
• Proven ability to manage multiple assessments and competing priorities simultaneously.
• Professional certifications such as CRISC, CISA, CompTIA Security+, ISO 27001 Lead Implementer/Auditor or similar are desirable.

Mandatory Requirements

• Current NV1 Security Clearance, or the ability to obtain and maintain an NV1 Security Clearance.
• Ability to handle sensitive information and apply sound judgement in accordance with security, privacy and governance requirements.

Candidates must possess existing Australian working rights (Citizens and be able to obtain NV1 Clearance) and live in the Greater Sydney Area.