Senior Third-Party Cyber Risk Analyst

FM; Johnston (RI); On-site; USD 110,000 - 150,000; Full time

Job summary

FM is seeking a Senior Information Security Analyst specializing in Third-Party Risk Management (TPRM). You will lead end-to-end risk assessments of external vendors, SaaS platforms, and cloud solutions, focusing on data handling, storage, and integration with internal systems.

You will partner with business, technology, and procurement teams to identify risks and implement practical mitigation strategies, guiding risk governance and alignment with regulatory expectations.

Qualifications

• Minimum 5+ years in cybersecurity, risk, or related fields with TPRM experience.
• Experience assessing vendor security posture in cloud and enterprise environments.

Responsibilities

• Lead end-to-end third-party risk assessments and vendor security reviews.
• Evaluate vendor security programs and governance, including architecture and data flows.
• Identify risks in data protection, privacy, IAM, and external attack surface.
• Interpret SOC 1/SOC 2 and ISO 27001 reports to identify gaps and risk.
• Collaborate with business, technology, procurement and legal teams on risk decisions.
• Contribute to FM's TPRM framework and align with standards (NIST, ISO 27001, NYDFS).

Skills

Cybersecurity

TPRM

Vendor security

Cloud security

IAM

Job description

FM is seeking a Senior Information Security Analyst specializing in Third-Party Risk Management (TPRM). You will lead end-to-end risk assessments of external vendors, SaaS platforms, and cloud solutions, focusing on data handling, storage, and integration with internal systems.

You will partner with business, technology, and procurement teams to identify risks and implement practical mitigation strategies, guiding risk governance and alignment with regulatory expectations.