Associate Cybersecurity Risk Analyst

Finthrive; Gurugram District; Presencial; INR 1.000.000 - 1.800.000; Tempo integral

Resumo da vaga

Finthrive is seeking a Security Risk Manager to execute and mature the Third-Party Risk Management program. You will assess vendor security posture against SOC 2, HIPAA, ISO 27001, and other frameworks, drive remediation, and support customer inquiries with clear, compliant responses.

Collaboration with Legal, Procurement, and cross-functional teams will be essential to embed security requirements in contracts and ensure consistent security posture messaging to customers.

Qualificações

• 2-5 years in information security or third-party risk management.
• Experience responding to customer security questionnaires and assessing vendor posture against SOC 2, HIPAA, ISO 27001.
• Knowledge of IAM, vulnerability management, encryption, logging, incident response, and data handling.

Responsabilidades

• Execute and mature the day-to-day TPRM program with risk-based vendor tiering.
• Perform vendor security assessments using SIG, CAIQ, and evidence artifacts.
• Document findings and drive remediation to closure.
• Support continuous monitoring and secure vendor offboarding.
• Translate security concepts for customers and represent Finthrive's security posture to prospects.

Conhecimentos

Information security

Third party risk management

Customer security questionnaires

Communication skills

Cross-functional collaboration

Security controls

GRC

SOC 2 knowledge

Regulatory frameworks

Formação

Bachelor's degree in IT or Information Security

Ferramentas

Whistic

Vanta

SafeBase

Descrição da vaga

Role & responsibilities

• Third Party Security Risk Management
• Execute and mature the day-to-day TPRM program, including risk-based vendor tiering aligned to data sensitivity, criticality, and regulatory obligations.
• Perform vendor security assessments using questionnaires and evidence (SIG, CAIQ, custom) and review assurance artifacts such as SOC 2 Type II, ISO 27001, HITRUST, PCI, and pen test results.
• Document findings, drive remediation to closure, and manage time-bounded risk acceptances and exceptions.
• Support continuous monitoring (security ratings, attestation refresh) and secure vendor offboarding.
• Partner with Legal and Procurement to embed security requirements in contracts (security addendums, DPAs, breach notification, right to audit).
• Customer Security Inquiries
• Manage and respond to customer security questionnaires, RFPs, and due diligence requests.
• Maintain a repository of standardized responses and supporting documentation to enable cross-functional team independence.
• Translate complex security concepts into customer-friendly language and represent FinThrives security posture to prospects and customers.
• Cross-Functional Collaboration & Tooling
• Work closely with IT, Engineering, Product, and Sales to ensure timely, accurate completion of both vendor and customer reviews.
• Implement and manage tools (e.g., Whistic, Vanta, security ratings platforms) to streamline and automate inquiry and assessment workflows.
• Produce metrics and dashboards covering vendor risk posture, remediation aging, inquiry volume, and SLA performance.
• Product, Infrastructure & Compliance Knowledge
• Maintain a strong understanding of FinThrives products, SaaS architecture, data flows, and security controls.
• Support FinThrives Audit and Compliance program by aligning activities to HITRUST, HIPAA, SOC 2, NIST, and ISO 27001 requirements.

Preferred candidate profile

• 2-5 years of relevant experience in information security, third party risk management, GRC, or due diligence response. \
• Experience responding to customer security questionnaires and assessing vendor security posture against frameworks (SOC 2, HIPAA, ISO 27001).
• Working knowledge of security control domains: IAM, vulnerability management, encryption, logging/monitoring, incident response, and data handling.
• Familiarity with IT infrastructure (servers, firewalls, load balancers, databases), SaaS architecture, and web applications.
• Strong written and verbal communication skills, with the ability to explain technical
• concepts to non-technical audiences.
• Customer-centric mindset with experience collaborating with Sales teams and customers.
• Proficiency with Microsoft Office (Word, Excel, PowerPoint, Visio).
• Bachelors degree (IT, Information Security, or Business Administration preferred).
• Preferred Skills
  • Security+ or similar certification.
  • Familiarity with HITRUST, NIST, PCI DSS, and GDPR/CCPA.
  • Experience with Trust Center, questionnaire management, and continuous monitoring platforms (SafeBase, Whistic, Vanta).
  • Familiarity with cloud provider assurance models (AWS/Azure/GCP shared responsibility) and SaaS risk patterns.