Senior TPRM & AI Security Analyst

DoorDash; San Francisco (CA); On-site; USD 132,600 - 195,000; Full time

Benefits offered by this job

401(k) with employer matching

Paid parental leave

Wellness benefits

Commuter benefits

Paid time off

Paid sick leave

Medical, dental, and vision benefits

Holiday pay

Disability and life insurance

Family‑forming assistance

Job summary

DoorDash is seeking a security-focused Third-Party Risk Management (TPRM) Sr. Analyst to mature our program and lead risk assessments across the vendor ecosystem. You will drive continuous security improvements, partner with security engineering, procurement, privacy, and legal, and champion scalable governance and reporting.

You will oversee due diligence, audits, and remediation for cloud, SaaS, and AI-based solutions, ensuring data protection and resilience across a global platform.

Qualifications

• 7+ years of progressive experience in security-focused TPRM methodologies.
• Bachelor’s or Master’s degree in Information Security, Computer Science, Business Administration, or related field.
• Experience with program building, conducting security and/or assurance audits, controls, and risk assessments, and remediation management.
• Deep technical understanding and experience conducting comprehensive security risk and gap assessments of cloud, SaaS, including AI solutions, and infrastructure vendors, and evaluating risks that impact data security and application resilience.
• Proficiency in the technical review of core security assurance documentation (CAIQ, SIG, SOC 2 Type 2, Penetration Test reports, ISO 27001, PCI-DSS).
• Experience in the technical vetting of complex vendor solutions, API integrations, cloud services, and AI platforms for vulnerabilities and data leakage.
• Practical experience in assessing risks associated with AI/ML models, including data provenance and model poisoning risks.
• Experience implementing major information security, privacy, and risk management frameworks (NIST, ISO, SOC 2).
• Experience managing security and compliance programs across broad GRC disciplines in a global company.
• Experience solving complex, systemic issues with cross-functional collaboration.
• Experience managing vendor risk across the lifecycle, including re-assessments and continuous monitoring.
• Excellent verbal and written communication with leadership.
• Certifications such as CISA, CISSP, CISM are a plus.

Responsibilities

• Drive maturation of the TPRM program from reactive to proactive security partnership.
• Architect and govern security for the BPO and contingent worker ecosystem, with continuous security standards and robust controls.
• Design and build process automations to scale the TPRM program.
• Lead the Supplier Security AI Governance framework and evaluate AI risks across the business.
• Own governance reporting, metrics, dashboards, and leadership updates on third-party risk exposure.
• Partner with security engineering, procurement, business, privacy, and legal to provide security advisory and risk assessments.
• Lead end-to-end issues and remediation tracking from assessments to closure.
• Execute core TPRM lifecycle: risk assessments, due diligence, onboarding, and contract reviews, refining policies for scale.

Skills

TPRM experience

Security risk assessment

Vendor risk management

AI/ML risk assessment

Security frameworks

Security documentation reviews

Cloud/SaaS risk vetting

Communication skills

Problem solving

GRC leadership

Education

Bachelor’s or Master’s in Information Security/CS/Business Admin

Tools

CAIQ & SOC reports reviews

Penetration testing reports

Job description

DoorDash is seeking a security-focused Third-Party Risk Management (TPRM) Sr. Analyst to mature our program and lead risk assessments across the vendor ecosystem. You will drive continuous security improvements, partner with security engineering, procurement, privacy, and legal, and champion scalable governance and reporting.

You will oversee due diligence, audits, and remediation for cloud, SaaS, and AI-based solutions, ensuring data protection and resilience across a global platform.