Senior Vendor Security & TPRM Analyst

X.ai; Palo Alto (CA); On-site; USD 132,000 - 228,000; Full time

Job summary

SpaceXSI is seeking a mid-to-senior Governance, Risk, and Compliance professional focused on third-party risk management (TPRM) to own and scale our vendor risk program. You will work across procurement, legal, security, privacy, engineering and business owners to keep third-party risk clear, proportionate, and actionable.

The role requires expertise in cloud services, IAM, encryption, data flows, and AI governance frameworks, with experience evaluating and approving residual risk and

Qualifications

• Bachelor's degree or equivalent in CS/InfoSec/engineering.
• Minimum 5 years in third-party risk management, vendor security, or security governance & risk.
• Experience with SOC 2, ISO 27001, NIST CSF in vendor assessments.

Responsibilities

• Own the end-to-end third-party risk lifecycle—from intake to offboarding—for vendors and partners.
• Design and maintain risk-tiering methodology and questionnaires.
• Conduct security, privacy and business due diligence; review architectures, data flows, and controls.
• Review SOC 1/SOC 2 Type II, ISO 27001, ISO 42001 certificates and related reports.
• Translate findings into risk decisions and document exceptions with owners and expiration dates.
• Partner with Legal and Procurement to define and negotiate security terms and DPAs.
• Assess AI vendors and AI-enabled services for governance and data handling.

Skills

TPRM experience

Vendor security assessments

GRC proficiency

Cloud security & IAM

Risk communication

Education

Bachelor's degree in computer science, information security, cybersecurity, or related STEM

Tools

Vanta or similar GRC platform

Security ratings tools (BitSight/UpGuard)

Job description

SpaceXSI is seeking a mid-to-senior Governance, Risk, and Compliance professional focused on third-party risk management (TPRM) to own and scale our vendor risk program. You will work across procurement, legal, security, privacy, engineering and business owners to keep third-party risk clear, proportionate, and actionable.

The role requires expertise in cloud services, IAM, encryption, data flows, and AI governance frameworks, with experience evaluating and approving residual risk and