Senior Tech Risk & Vendor Security Lead

Sungrow Na; Northern (KY); Hybrid; USD 136,000 - 184,000; Full time

Job summary

Sungrow Americas is seeking a Senior Technology Risk Analyst to support execution and improvement of the risk management program. You will perform vendor security assessments, review evidence, validate controls, and coordinate remediation in a mature vendor risk program.

Ideal candidate has strong experience reviewing security docs, collaborating with Procurement, Legal, IT, Engineering, and Product Security, translating findings into business risk, and strengthening cybersecurity posture across

Qualifications

• Experience reviewing security documentation and evidence for third-party vendors.
• Ability to translate technical findings into business risk implications.
• Proven collaboration across Procurement, Legal, IT, Engineering, and security teams.
• Strong understanding of vendor risk management and regulatory expectations.

Responsibilities

• Execute vendor risk lifecycle activities including onboarding, reassessments, renewals, and offboarding.
• Perform security assessments for software, cloud, and service providers.
• Review SOC 2, ISO 27001, pen tests, and privacy controls for vendors.
• Monitor vendor risk posture and coordinate remediation until closure.
• Prepare governance reports and support audits, customer inquiries, and reviews.
• Assist Procurement and Legal during onboarding and contract renewals.

Skills

Vendor security assessments

Third-Party risk management

Security documentation review

Cross-functional collaboration

Tools

GRC platforms

Job description

Sungrow Americas is seeking a Senior Technology Risk Analyst to support execution and improvement of the risk management program. You will perform vendor security assessments, review evidence, validate controls, and coordinate remediation in a mature vendor risk program.

Ideal candidate has strong experience reviewing security docs, collaborating with Procurement, Legal, IT, Engineering, and Product Security, translating findings into business risk, and strengthening cybersecurity posture across