Senior Third-Party Risk Analyst, Ecosystem Security

MoneyLion; San Francisco (CA); On-site; USD 140,000 - 190,000; Full time

Job summary

Plaid in San Francisco seeks a Security Risk Assessor to run vendor risk assessments end-to-end—from intake and questionnaire to risk rating and tracked findings. You will vet customer and partner security postures onboarding to the platform, maintain a current risk register, and help mature the program with tiering, runbooks, and AI-assisted tooling to scale reviews.

Strong communication with Procurement, Legal, and GTM is essential as we translate security controls into actionable risk signals

Qualifications

• 4+ years of experience in vendor risk management.
• Experience running security risk assessments of third parties—questionnaires, SOC 2/ISO reports, and security docs.
• Knowledge of third-party risk lifecycle: intake, tiering, exceptions, remediation, reassessment.
• Familiarity with SOC 2, ISO 27001, NIST CSF and control domains.
• Proven ability to mature a vendor risk program and document findings clearly.
• Strong communication across security, legal, procurement, and GTM.

Responsibilities

• Run Vendor Security Risk Assessments: triage, review, rate risk, document findings and exceptions.
• Vet Customer and Partner Security Posture: ensure onboarding meets security bar before touching data.
• Keep the Third-Party Risk Lifecycle Current: tiering, reassessments, remediation follow-through, risk register upkeep.
• Mature the Program: improve questionnaires, tiering, intake, and runbooks; scale reviews with automation.
• Report on Ecosystem Risk: track cycle times, backlog, and program health for leadership.
• Mature through AI and tooling: apply AI to assessment review and reporting to increase throughput.

Skills

Vendor risk management

Security risk assessments

Communication

Cross-functional collaboration

AI tooling

Tools

OneTrust

ProcessUnity

Whistic

SecurityScorecard

Job description

Plaid in San Francisco seeks a Security Risk Assessor to run vendor risk assessments end-to-end—from intake and questionnaire to risk rating and tracked findings. You will vet customer and partner security postures onboarding to the platform, maintain a current risk register, and help mature the program with tiering, runbooks, and AI-assisted tooling to scale reviews.

Strong communication with Procurement, Legal, and GTM is essential as we translate security controls into actionable risk signals