Senior Vendor Security Risk Lead

Cloudflare; Austin (TX); On-site; USD 150,000 - 190,000; Full time

Job summary

Cloudflare is seeking a Security Third Party Risk Management Lead in Austin, TX. This senior individual-contributor role will own the vendor risk program, drive reviews and risk decisions, and mentor analysts.

You’ll work with Procurement, Legal, Privacy, and Security to shape risk posture and vendor engagements. You will set the operational bar, lead improvements, and ensure scalable, high-quality assessments across cloud, software, hardware, and data centers.

Qualifications

• 8+ years in Security GRC or a related field.
• End-to-end vendor risk program experience.
• Expertise across ISO 27001, SOC 2, PCI, NIST 800-53.
• Experience mentoring peers and guiding teams.
• Proven ability to influence cross-functional stakeholders.

Responsibilities

• Lead and own the Third Party Risk program execution and improvements.
• Serve as SME for vendor security review methodology and risk decisions.
• Oversee vendor risk assessments and security contract terms.
• Mentor Third Party Risk Management Specialists on methodology and tooling.
• Collaborate with Procurement, Legal, Privacy, and Security teams across the vendor lifecycle.
• Provide guidance on risk findings, policy exceptions, and escalation handling.
• Support negotiation of security terms with vendors and resolve escalations.
• Report program posture to security leadership and stakeholders.

Skills

Security GRC

Vendor risk

ISO 27001

SOC 2

PCI

NIST 800-53

Mentoring

Cross-functional influence

Job description

Cloudflare is seeking a Security Third Party Risk Management Lead in Austin, TX. This senior individual-contributor role will own the vendor risk program, drive reviews and risk decisions, and mentor analysts.

You’ll work with Procurement, Legal, Privacy, and Security to shape risk posture and vendor engagements. You will set the operational bar, lead improvements, and ensure scalable, high-quality assessments across cloud, software, hardware, and data centers.