Fractional SCRM Analyst: ISO 27001 Vendor Risk

Gofractional; Austin (TX); Hybrid; USD 90,000 - 130,000; Full time

Job summary

Crux Security is seeking a self-directed Supply Chain Analyst to stand up a SCRM program for a client engagement in Austin, TX. This contract/fractional role will drive vendor risk tiering, SOC 2 and ISO 27001 review processes, and an audit-ready evidence package with formal procedures.

You will build a supplier register from scratch, design tiering criteria, and coordinate with Legal and Procurement to ensure security clauses and a SaaS procurement checklist are operable and auditable for

Qualifications

• Demonstrated experience designing or applying a vendor risk tiering methodology
• Experience drafting or revising security contract clauses / annexes, ideally in coordination with Legal
• Experience reviewing SOC 2 reports and ISO 27001 certifications from a vendor risk perspective
• Experience designing procurement-stage security checklists or vendor questionnaires for SaaS
• Comfortable coordinating directly with Procurement and Legal stakeholders
• Experience building supplier inventories or risk registers
• Working knowledge of ISO 27001:2022 evidence requirements and audit expectations
• Able to work independently against a defined scope with minimal supervision, escalating judgment calls rather than routine questions
• Strong written communication; proficiency producing audit-ready documentation with limited rework
• Must pass a background check and comply with client security policies

Responsibilities

• Build a supplier register from scratch and consolidate sources into a single, structured artifact
• Design and apply a vendor risk tiering methodology
• Review and update security contract clauses alongside Legal
• Stand up a SOC 2 / ISO 27001 certification review process for critical vendors
• Design a SaaS procurement security checklist
• Coordinate with Procurement and Legal throughout checklist design
• Produce an audit-ready evidence package mapped to ISO controls
• Document operational procedures and develop a handoff plan to Procurement as long-term owner

Skills

Vendor risk tiering

SOC 2 awareness

ISO 27001 familiarity

Procurement security

Contract clauses drafting

Cross-functional collaboration

Audit readiness documentation

Job description

Crux Security is seeking a self-directed Supply Chain Analyst to stand up a SCRM program for a client engagement in Austin, TX. This contract/fractional role will drive vendor risk tiering, SOC 2 and ISO 27001 review processes, and an audit-ready evidence package with formal procedures.

You will build a supplier register from scratch, design tiering criteria, and coordinate with Legal and Procurement to ensure security clauses and a SaaS procurement checklist are operable and auditable for