Senior Vendor Security Risk Analyst

Turo; San Francisco (CA); Hybrid; USD 131,000 - 164,000; Full time

Benefits offered by this job

Equity and benefits for all full-time

Employer-paid health/dental/vision

Retirement match

Learning stipend

Travel credit

Phone/internet stipend

Job summary

Turo, a leading car sharing marketplace, seeks a Senior Vendor Security Risk Analyst to own the third-party security risk management program within Enterprise Security. You will assess vendor evidence, review contracts for security, and partner with Legal and Procurement to strengthen our security posture.

You will build scalable review processes, deliver security awareness training, and run quarterly access reviews, reporting metrics to security leadership.

Qualifications

• 5+ years in third-party risk management, vendor security, or GRC.
• Experience evaluating SOC 2 reports, ISO certificates, and pen tests.
• Familiarity with DPAs and MSAs; ability to work with Legal and Procurement.
• Knowledge of cloud security (AWS), IAM, and data protection.

Responsibilities

• Own the vendor security review lifecycle end-to-end.
• Evaluate vendor evidence and issue risk recommendations.
• Review contracts from a security perspective (DPAs/MSAs).
• Build scalable tiering, intake workflows, and continuous monitoring.
• Partner with Procurement, Legal, and Privacy to integrate security reviews.
• Design and deliver security awareness training and phishing simulations.
• Lead quarterly user access review campaigns and remediation.
• Report TPRM, training, and access metrics to security leadership.

Skills

Vendor risk management

SOC 2

ISO certifications

Penetration testing results

GRC tooling

Security awareness training

Cloud security (AWS)

Education

Bachelor's degree in CS or InfoSec

Security certification (CISA/CISM/CISSP)

Tools

Vanta

Drata

ZenGRC

Phishing simulations

Job description

About the team

Turo is searching for a highly motivated and versatile Senior Vendor Security Risk Analyst under the Enterprise Security team to own Turo's third-party security risk management (TPRM) program and partners with Security teammates to lead security awareness training and user access review campaigns. You will assess and manage vendor risk end-to-end, build scalable review processes, and help strengthen Turo's security culture. You will operate with significant autonomy across Procurement, Legal, Privacy, IT, and the business.

Own the vendor security review lifecycle: intake, risk tiering, due diligence, findings documentation, remediation tracking, and renewals.

Evaluate vendor evidence: SOC 2 reports, ISO certificates, pen-test results, and security questionnaires - deliver clear risk recommendations.

Review vendor contracts, DPAs, and MSAs from a security standpoint; provide approval recommendations before contracts are signed.

Build scalable tiering frameworks, intake workflows, and continuous monitoring capabilities that grow with vendor volume.

Partner with Procurement, Legal, and Privacy to integrate security review into onboarding and renewal cycles without becoming a bottleneck.

Complete and maintain external partnership-facing security questionnaires and trust-center content in support of integrations.

Partner with Security team members to design and deliver security awareness training programs, including role-specific content on phishing, social engineering, third-party risk, and data handling.

Track training completion and effectiveness; align program content with TPRM findings and emerging threats.

Partner with IT and Security teams to design and run quarterly user access review campaigns, ensuring timely completion, accurate certification decisions, and clear remediation of access exceptions.

Report on TPRM, training, and access review metrics to security leadership: cycle time, open findings, remediation aging, and completion rates.

Your profile

5+ years in third-party risk management, vendor security, or GRC, with direct ownership of vendor security review programs. Hands-on experience evaluating SOC 2 reports, ISO certificates, and penetration test results, and translating findings into business-ready risk recommendations. Familiarity with contract review from a security perspective (e.g., DPAs & MSA) and comfort working with Legal and Procurement. Working knowledge of cloud security (AWS), IAM, and data-protection principles. Strong communicator: able to distill complex risk findings for non-technical stakeholders at all levels. Bachelor's degree in Computer Science, Information Security, Information Assurance or equivalent practical experience. Relevant certification: CISA, CISM, CISSP, or equivalent security certification. Experience with TPRM or GRC tooling (e.g., Vanta, Drata, ZenGRC) and security-automation platforms. Experience developing or delivering security awareness training, including content creation or phishing simulation. Background in a regulated or high-trust industry - fintech, marketplace, or SaaS handling sensitive data.

Benefits

• Competitive salary, equity, benefits, and perks for all full-time employees
• Employer-paid medical, dental, and vision insurance (Country specific)
• Retirement employer match
• Learning & Development stipend to invest in your professional development
• Turo host matching program
• Turo travel credit
• Cell phone and internet stipend
• Paid time off to relax and recharge
• Paid holidays, volunteer time off, and parental leave
• For those who are in the office full-time or hybrid we have in-office lunch, office snacks, and fun activities

About Turo

Turo is the world’s largest car sharing marketplace where you can book the perfect car for wherever you’re going from a vibrant community of trusted hosts across the US, UK, Canada, Australia, and France. Whether you're flying in from afar or looking for a car down the street, searching for a rugged truck or something smooth and swanky, Turo puts you in the driver’s seat of an extraordinary selection of cars shared by local hosts.

Discover Turo at https://turo.com, the App Store, and Google Play, and check out our blog, Field Notes.

Turo is an Equal Opportunity Employer and a participant in the U.S. Federal E-Verify program. Women, minorities, individuals with disabilities and protected veterans are encouraged to apply. We welcome people of different backgrounds, experiences, abilities and perspectives.

Turo will consider qualified applicants with criminal histories in a manner consistent with the San Francisco Fair Chance Ordinance, as applicable.

We welcome candidates with physical, mental, and/or neurological disabilities. If you require assistance applying for an open position, or need accommodation during the recruiting process due to a disability, please submit a request to People Operations by emailing [e-mail].

Welcome to Turo Careers! Turo is the world’s largest car sharing marketplace where you can book the perfect car for wherever you’re going from a vibrant community of trusted hosts across the US, UK, Canada, Australia, and France. Whether you're flying in from afar or looking for a car down the street, searching for a rugged truck or something smooth and swanky, Turo puts you in the driver’s seat of an extraordinary selection of cars shared by local hosts.

Turo highly values having employees working in-office to foster a collaborative work environment and company culture. This is central to how we work, and this role will be subject to our current in-office hybrid schedule that requires Turists to work in the office three days per week on Mondays, Wednesdays, and Thursdays. We expect that employees will meet these required in-office days consistently as part of their role.

For this role, the target base salary range in San Francisco is $131,000-$164,000 annually.

This role is also eligible for equity and benefits.