Senior Vendor Security Risk & Compliance Lead

Turo; San Francisco (CA); Hybrid; USD 131,000 - 164,000; Full time

Benefits offered by this job

Equity and benefits for all full-time

Employer-paid health/dental/vision

Retirement match

Learning stipend

Travel credit

Phone/internet stipend

Job summary

Turo, a leading car sharing marketplace, seeks a Senior Vendor Security Risk Analyst to own the third-party security risk management program within Enterprise Security. You will assess vendor evidence, review contracts for security, and partner with Legal and Procurement to strengthen our security posture.

You will build scalable review processes, deliver security awareness training, and run quarterly access reviews, reporting metrics to security leadership.

Qualifications

• 5+ years in third-party risk management, vendor security, or GRC.
• Experience evaluating SOC 2 reports, ISO certificates, and pen tests.
• Familiarity with DPAs and MSAs; ability to work with Legal and Procurement.
• Knowledge of cloud security (AWS), IAM, and data protection.

Responsibilities

• Own the vendor security review lifecycle end-to-end.
• Evaluate vendor evidence and issue risk recommendations.
• Review contracts from a security perspective (DPAs/MSAs).
• Build scalable tiering, intake workflows, and continuous monitoring.
• Partner with Procurement, Legal, and Privacy to integrate security reviews.
• Design and deliver security awareness training and phishing simulations.
• Lead quarterly user access review campaigns and remediation.
• Report TPRM, training, and access metrics to security leadership.

Skills

Vendor risk management

SOC 2

ISO certifications

Penetration testing results

GRC tooling

Security awareness training

Cloud security (AWS)

Education

Bachelor's degree in CS or InfoSec

Security certification (CISA/CISM/CISSP)

Tools

Vanta

Drata

ZenGRC

Phishing simulations

Job description

Turo, a leading car sharing marketplace, seeks a Senior Vendor Security Risk Analyst to own the third-party security risk management program within Enterprise Security. You will assess vendor evidence, review contracts for security, and partner with Legal and Procurement to strengthen our security posture.

You will build scalable review processes, deliver security awareness training, and run quarterly access reviews, reporting metrics to security leadership.