Senior Third-Party Risk Management Analyst

Jobgether SRL; United States; Remote; USD 90,000 - 130,000; Full time

Benefits offered by this job

Medical, dental, and vision benefits

401(k) with company matching

Remote work flexibility

Flexible PTO

Job summary

Jobgether SRL is seeking a Senior Third-Party Risk Management Analyst based in the United States to help drive an enterprise-wide cybersecurity, risk, and compliance program with a strong emphasis on third-party risk.

You will assess vendors, applications, platforms, and service providers against regulatory requirements and work across cybersecurity, legal, procurement, product, client success, and leadership to translate findings into practical risk controls.

Qualifications

• 5+ years of professional experience in cybersecurity, third-party risk management, risk management, audit, or compliance.
• Strong knowledge of regulatory and compliance requirements including PCI DSS, SOC 2, GDPR, GLBA, HIPAA, SOX, HITRUST.
• Experience evaluating both legacy environments and modern cloud technologies (AWS, GCP, Azure).
• Strong understanding of APIs, application security, encryption, endpoint security, and network security concepts.
• Familiarity with SIEM, IDS, log management, vulnerability management, and threat intelligence.
• Ability to assess vendor controls and map controls to security frameworks; communicate risk clearly.
• Experience supporting SOC 2 Type II and PCI DSS audits is valuable.
• Familiarity with eGRC/ITGRC platforms (Jira Service Management GRC, Archer, OneTrust, LogicGate).
• Professional certifications such as CISSP, CISM, CISA, CRISC, CTPRA, or CTPRP desirable.
• Strong project management, organizational, prioritization, and multitasking skills.

Responsibilities

• Maintain the enterprise-wide inventory of third-party providers, applications, and services from onboarding to termination.
• Lead vendor cybersecurity assessments with stakeholders to identify risks and required controls.
• Evaluate vendor maturity against frameworks like NIST CSF, CIS, CMMC, GDPR, PCI DSS, and SOC 2.
• Review vendor SLAs, RPO/RTO, breach notification, cybersecurity insurance, and related obligations.
• Document assessment findings, remediation plans, exceptions, and compensating controls.
• Support audits by providing evidence and validating third-party controls for SOC 2 Type II and PCI DSS.
• Maintain audit-ready policies, standards, procedures, and risk treatment plans with GRC stakeholders.
• Collaborate with Threat & Vulnerability Management on client vulnerability notifications and communications.
• Provide consultative risk guidance to clients and internal stakeholders.
• Improve the information security management system by aligning third-party risk with policies and standards.
• Support control selection, risk treatment planning, cybersecurity metrics, and improvement initiatives.
• Monitor emerging threats, regulatory developments, and industry trends impacting third-party risk.

Skills

Vendor risk management

Cybersecurity

Communication

Project management

Stakeholder management

Analytical thinking

Remote collaboration

Attention to detail

Policy documentation

Training mentoring

Tools

Jira Service Management GRC

Archer

OneTrust

LogicGate

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Third-Party Risk Management Analyst based in United States.

This role is a key contributor to an enterprise-wide cybersecurity, risk, and compliance program, with a strong focus on third-party risk. You will assess vendors, applications, platforms, and service providers against cybersecurity, privacy, resiliency, and regulatory requirements. Working across cybersecurity, legal, procurement, product, client success, and leadership teams, you will turn complex risk findings into practical recommendations. You will support critical compliance programs, including SOC 2 Type II and PCI DSS, while helping maintain audit-ready documentation and controls. The role also contributes to vulnerability communications, business continuity, and continuous improvement of the broader information security management system. This is an opportunity to take meaningful ownership of a growing TPRM program in a collaborative, remote environment.

• Maintain the enterprise-wide inventory of third-party providers, applications, and services throughout their lifecycle, from onboarding through termination.
• Lead and coordinate vendor cybersecurity assessments, partnering with cybersecurity, legal, procurement, and business stakeholders to identify risks and required controls.
• Evaluate vendor maturity against frameworks and requirements including NIST CSF, CIS, CMMC, GDPR, PCI DSS, and SOC 2.
• Review vendor service-level agreements, RPO/RTO commitments, breach notification requirements, cybersecurity insurance, and other risk-related obligations.
• Document assessment findings, recommendations, remediation plans, exceptions, and compensating controls, ensuring risks are tracked through resolution.
• Support internal and external audits by providing evidence and validating third-party controls related to SOC 2 Type II, PCI DSS, and broader compliance requirements.
• Maintain audit-ready policies, standards, procedures, risk treatment plans, and supporting documentation in collaboration with GRC stakeholders.
• Partner with Threat & Vulnerability Management teams on client vulnerability notifications, ensuring communications are accurate, timely, and aligned with contractual and industry requirements.
• Provide consultative guidance to clients and internal stakeholders regarding risk impact, remediation expectations, and recommended cybersecurity practices.
• Contribute to the continuous improvement of the information security management system by aligning third-party risk processes with organizational policies, standards, and procedures.
• Support control selection, risk treatment planning, cybersecurity metrics, and initiatives designed to measure and improve control effectiveness.
• Monitor emerging cybersecurity threats, regulatory developments, and industry trends that may affect third-party risk and organizational resilience.
• Support disaster recovery and business continuity planning related to vendor dependencies and resilience requirements.
• Act as a trusted point of contact for business units managing vendor-related risks and coordinate risk reduction strategies across legal, cybersecurity, and leadership teams.
• Promote cybersecurity awareness through outreach, training, documentation, and knowledge-sharing initiatives.
• Mentor colleagues and contribute to internal training materials, process documentation, and the continued maturity of the third-party risk program.

Requirements

• 5+ years of professional experience in cybersecurity, third-party risk management, risk management, audit, compliance, or a closely related discipline.
• Strong knowledge of regulatory and compliance requirements, including PCI DSS, SOC 2, GDPR, GLBA, HIPAA, SOX, and HITRUST.
• Demonstrated experience evaluating both legacy environments and modern cloud technologies, including AWS, GCP, and Azure.
• Strong understanding of APIs, application security, encryption, endpoint security, and network security concepts.
• Familiarity with SIEM, intrusion detection systems, log management, vulnerability management, and threat intelligence.
• Proven ability to assess vendor controls, map controls to recognized security frameworks, identify gaps, and clearly communicate risk to technical and non-technical stakeholders.
• Experience supporting SOC 2 Type II and PCI DSS audits is highly valuable.
• Familiarity with eGRC or ITGRC platforms such as Jira Service Management GRC, Archer, OneTrust, or LogicGate is preferred.
• Professional certifications such as CISSP, CISM, CISA, CRISC, CTPRA, or CTPRP are desirable.
• Strong project management, organizational, prioritization, and multitasking skills, with the ability to manage multiple vendor assessments and compliance activities simultaneously.
• Excellent written and verbal communication skills, including the ability to translate complex cybersecurity topics into clear, actionable guidance.
• Strong stakeholder-management skills and the ability to collaborate effectively across cybersecurity, legal, procurement, product, client success, and executive teams.
• A proactive, analytical, and consultative approach to identifying risk and developing practical solutions.
• Strong professionalism, empathy, and customer-service orientation when working with both internal and external stakeholders.
• Ability to work remotely and independently while maintaining strong collaboration and accountability.
• Candidates must be authorized to work in the United States without sponsorship.

Benefits

• Medical, dental, and vision benefits.
• 401(k) savings plan with company matching.
• Flexible planned paid time off.
• Generous sick leave.
• Employer-paid parental leave.
• Employer-paid short-term disability coverage.
• Remote work flexibility.
• Strong emphasis on work-life balance.
• Inclusive and welcoming work environment.
• Purpose-driven culture focused on creating meaningful impact.
• Opportunities to contribute to community-focused initiatives.
• Collaborative environment with an emphasis on innovation, professional growth, and employee engagement.