External Inquiry Analyst

TikTok USDS Joint Venture; Washington (District of Columbia); On-site; USD 89,000 - 176,000; Full time

Job summary

TikTok USDS Joint Venture is seeking an External Inquiry Analyst, Security & Privacy. This high-visibility role focuses on building and maturing the external inquiry and trust assurance function from scratch, coordinating with Legal, Communications, Public Policy, and Engineering to deliver accurate, externally-facing documentation.

You will triage complex vendor and client security assessments, translate technical evidence into clear narratives, and support the enterprise sales lifecycle with

Qualifications

• 4+ years of applicable experience in Information Security, Privacy, IT Audit, TPRM, or Technical Compliance.
• Bachelor’s degree in Information Security, Computer Science, Risk Management, Cybersecurity Policy, or a related technical/business discipline.
• Strong foundational understanding of 2nd Line of Defense (2LoD) principles, data residency/sovereignty concepts, data boundaries, network architecture, and major compliance frameworks (SOC 2 Type II, ISO 27001, PCI-DSS, NIST CSF/800-53).
• Exceptional written and verbal communication skills, with a demonstrated ability to translate dense technical architecture and legal/compliance mandates into clear, executive-ready external documentation.
• Demonstrated ability to thrive in ambiguous, fast-paced environments, take complete ownership of vague mandates, and build structure, SLAs, and processes independently.
• Strong project management and interpersonal skills, with a proven ability to lead cross-functional working groups and influence stakeholders across Legal, Communications, Public Policy, Product, and Engineering.

Responsibilities

• Support the lead to design, build, and scale the External Security & Privacy Inquiry function from the ground up, defining response SLAs, escalation paths, cross-functional review frameworks.
• Support intake, analysis, technical drafting, and delivery of complex external security, privacy, and data boundary inquiries from enterprise clients, advertisers, partners, and government bodies.
• Facilitate cross-functional working groups, aligning with Legal, Communications, Public Policy, Technical SMEs, and Business Development on disclosures and response strategies.
• Maintain a centralized knowledge base and customer-facing trust documentation to streamline inquiry lifecycles.
• Partner with enterprise sales, business development, and commercial teams to understand deal pipelines and deliver tailored trust assurance.
• Collaborate with engineering and CGRM teams to leverage AI risk platforms and automated tools to develop responses efficiently.
• Translate complex evidence and third-party attestations (SOC 2, ISO 27001, PCI-DSS) into clear external narratives.
• Jointly triage inquiries with Global Security and co-manage architecture questions for unified external responses.

Skills

2LoD principles

Written & verbal communication

Ownership & initiative

Cross-functional collaboration

Project management

Education

Bachelor's degree in CS/InfoSec

Job description

About the Team

TikTok USDS Joint Venture LLC is dedicated to the safety and security of millions of Americans who create, discover, and connect with what they love on our apps. USDS JV operates a comprehensive data privacy and cybersecurity program under defined safeguards to protect national security and secure U.S. user data, apps, and the algorithm.

The USDS Security & Privacy - Compliance, Governance, and Risk Management team is responsible for managing USDS security compliance in accordance with U.S. national security requirements and objectives, providing industry-leading GRC services.

Within this function, the External Security & Privacy Inquiry program serves as the primary liaison and front-line defense for external trust assurance. This function owns the end-to-end strategy, intake, cross-functional triage, technical writing, and execution of external security and privacy inquiries from commercial clients, enterprise advertisers, strategic partners, and government entities.

About the Role

TikTok USDS JV is seeking a proactive, highly autonomous, and technical External Inquiry Analyst, Security & Privacy. This is a high-visibility, 0 to 1 opportunity to help build, scale, and mature our external inquiry and trust assurance function from scratch.

You will be responsible for supporting a centralized, repeatable workflow to field, triage, and respond to complex compliance and security questionnaires, external vendor and client security assessments, technical architecture deep-dives, and government/regulatory questionnaires.

As a primary business enabler, you will bridge the gap between technical security teams, Legal, Communications, Public Policy, and commercial stakeholders—ensuring our external security posture is accurately and consistently communicated while directly supporting the enterprise sales lifecycle and trust profile.

Responsibilities

• Support the lead to design, build, and scale the USDS JV External Security & Privacy Inquiry function from the ground up, defining response SLAs, escalation paths, cross-functional review frameworks, and quality standards.
• Support the end-to-end intake, analysis, technical drafting, and delivery of complex external security, privacy, and data boundary inquiries from enterprise clients, advertisers, strategic partners, and government bodies.
• Facilitate cross-functional working groups, aligning with Legal, Communications, Public Policy, Technical SMEs, and Business Development on sensitive disclosures, custom FAQs, and overall response strategies.
• Maintain a centralized knowledge base and customer-facing trust documentation to streamline future inquiry lifecycles and eliminate redundant SME review cycles.
• Partner closely with enterprise sales, business development, and commercial teams to understand deal pipelines, identify security blockers early in the sales lifecycle, and deliver tailored trust assurance that satisfies client security assessments without oversharing sensitive internal IP.
• Collaborate with internal engineering and CGRM teams to leverage AI risk platforms, automated intake tools, and LLM-assisted repository searching to efficiently develop responses and reduce manual administrative overhead on technical SMEs.
• Translate complex technical evidence, 2nd Line of Defense controls, and third-party attestations (e.g., SOC 2, ISO 27001, PCI-DSS) into clear, external-ready narratives.
• Jointly triage inbound inquiries with Global Security counterparts, taking ownership of USDS JV topics while co-managing global architecture questions to deliver unified responses to external stakeholders.

Qualifications

Minimum Qualifications:

• 4+ years of applicable experience in Information Security, Privacy, IT Audit, Third-Party Risk Management (TPRM), or Technical Compliance within a complex, high-growth technology enterprise or highly regulated environment.
• Bachelor’s degree in Information Security, Computer Science, Risk Management, Cybersecurity Policy, or a related technical/business discipline.
• Strong foundational understanding of 2nd Line of Defense (2LoD) principles, data residency/sovereignty concepts, data boundaries, network architecture, and major compliance frameworks (SOC 2 Type II, ISO 27001, PCI-DSS, NIST CSF/800-53).
• Exceptional written and verbal communication skills, with a demonstrated ability to translate dense technical architecture and legal/compliance mandates into clear, executive-ready, and defensible external documentation.
• Demonstrated ability to thrive in ambiguous, fast-paced environments, take complete ownership of vague mandates, and build structure, SLAs, and processes independently without hands-on management.
• Strong project management and interpersonal skills, with a proven ability to lead cross-functional working groups and influence stakeholders across Legal, Communications, Public Policy, Product, and Engineering.

Preferred Qualifications:

• One or more industry-recognized certifications: CISA, CDPSE, CISM, CRISC, CISSP, CIPP/US, or PMP.
• Proven track record of independently managing, writing, and executing complex vendor security questionnaires, client security assessments, or regulatory inquiries from end to end.
• Direct experience operating at the intersection of Security/Compliance and Enterprise Sales, with a clear understanding of deal pipelines, commercial SLAs, and customer trust assurance.
• Hands-on experience implementing or utilizing AI-driven questionnaire tools, GRC platforms, or automated data pipelines to streamline compliance operations.

About USDS

TikTok USDS Joint Venture LLC is dedicated to the safety and security of millions of Americans who create, discover, and connect with what they love on the apps we operate. The Joint Venture has been established in compliance with the Executive Order signed by President Trump on September 25, 2025. Our foundation is a comprehensive data privacy and cybersecurity program we operate under defined safeguards to protect national security and secure U.S. user data, apps and the algorithm. We safeguard the U.S. content ecosystem, holding decision-making authority for trust and safety policies and moderation. USDS Joint Venture helps ensure Americans can continue to express their creativity, discover new hobbies and interests, and build thriving communities and businesses on a global scale.

On-site presence across teams allows the company to operate with greater speed, alignment, and agility — especially in areas like real-time decision-making, team development, and integrated execution. As such, the company is shifting from a hybrid work model to a fully in-person schedule up to 5 days a week.

Why Join Us

Inspiring creativity is at the core of TikTok's mission. Our innovative product is built to help people authentically express themselves, discover and connect – and our global, diverse teams make that possible. Together, we create value for our communities, inspire creativity and bring joy - a mission we work towards every day.

We strive to do great things with great people. We lead with curiosity, humility, and a desire to make impact in a rapidly growing tech company. Every challenge is an opportunity to learn and innovate as one team. We're resilient and embrace challenges as they come. By constantly iterating and fostering an "Always Day 1" mindset, we achieve meaningful breakthroughs for ourselves, our company, and our users. When we create and grow together, the possibilities are limitless. Join us.

Diversity & Inclusion

TikTok is committed to creating an inclusive space where employees are valued for their skills, experiences, and unique perspectives. Our platform connects people from across the globe and so does our workplace. At TikTok, our mission is to inspire creativity and bring joy. To achieve that goal, we are committed to celebrating our diverse voices and to creating an environment that reflects the many communities we reach. We are passionate about this and hope you are too.

USDS Reasonable Accommodation

USDS is committed to providing reasonable accommodations in our recruitment processes for candidates with disabilities, pregnancy, sincerely held religious beliefs or other reasons protected by applicable laws. If you need assistance or a reasonable accommodation, please reach out to us at https://tinyurl.com/USDS-RA

Job Information

【For Pay Transparency】 Compensation Description (Annually) - Washington, DC

The base salary range for this position in the selected city is $ 88920 - $ 176400 annually.

Compensation may vary outside of this range depending on a number of factors, including a candidate’s qualifications, skills, competencies and experience, and location. Base pay is one part of the Total Package that is provided to compensate and recognize employees for their work, and this role may be eligible for additional discretionary bonuses/incentives, and restricted stock units.

Benefits may vary depending on the nature of employment and the country work location. Employees have day one access to medical, dental, and vision insurance, a 401(k) savings plan with company match, paid parental leave, short-term and long-term disability coverage, life insurance, wellbeing benefits, among others. Employees also receive 10 paid holidays per year, 10 paid sick days per year and 17 days of Paid Personal Time (prorated upon hire with increasing accruals by tenure).

The Company reserves the right to modify or change these benefits programs at any time, with or without notice.