Senior Vendor Risk & Compliance Analyst

Evolution Cloud Services (EVOCS); United States; On-site; USD 85,000 - 120,000; Full time

Job summary

EVOCS is hiring four TPRM Analysts to join our fast-growing security program. As a TPRM Analyst, you will execute vendor assessments, manage evidence requests, and document findings so readers not on the call can understand exposure.

You will build remediation plans, track closure with vendors and internal owners, maintain audit-ready records, and produce status reports on findings and aging. We value written clarity and data quality.

Qualifications

• 5+ years of experience in cybersecurity, audit, compliance, risk, or vendor management.
• At least 3 years conducting vendor security assessments or third-party reviews.
• Hands-on with security questionnaires, evidence requests, control reviews, and remediation.
• Clear, structured written documentation that can be understood by non-participants.
• Strong focus on data quality and consistency across records.

Responsibilities

• Conduct vendor security assessments and third-party reviews in a high-volume queue.
• Issue and manage security questionnaires, chase evidence requests, and validate what is returned.
• Review control evidence (SOC 2, ISO 27001, penetration test summaries) and document coverage.
• Identify gaps, assign risk ratings, and write findings clearly for readers outside the review.
• Build remediation plans and track actions to closure with vendors and internal owners.
• Maintain audit-ready risk register entries and produce status reporting on aging and findings.

Skills

Vendor security assessment execution

Risk management

Data quality

Written documentation

Communication skills

Independent ownership

Security questionnaires

Control framework familiarity

Tools

SOC 2

ISO 27001

NIST CSF/NIST 800-53

Job description

EVOCS is hiring four TPRM Analysts to join our fast-growing security program. As a TPRM Analyst, you will execute vendor assessments, manage evidence requests, and document findings so readers not on the call can understand exposure.

You will build remediation plans, track closure with vendors and internal owners, maintain audit-ready records, and produce status reports on findings and aging. We value written clarity and data quality.