Strategic GRC & Vendor Risk Lead

Pinnacle Group, Inc.; Oregon; Hybrid; USD 90,000 - 130,000; Full time

Job summary

Pinnacle Group, Inc. seeks an experienced professional to own and manage the third‑party risk management program, coordinating with Information Security, Legal, Compliance, IT, and business stakeholders to address technology, cybersecurity, privacy, AI, and vendor risks.

You will review SOC 1/2, ISO 27001, and related reports, maintain risk documentation, and support audit readiness. The role focuses on ensuring accurate, complete, and well‑documented risk governance across vendors.

Qualifications

• Bachelor's degree in a related field.
• Experience in technology risk, governance, compliance, information security, audit, or third‑party risk management.
• Experience with vendor risk assessments for SaaS/cloud/AI-enabled products.
• Knowledge of ISO 27001, SOC, NIST, CIS Controls.

Responsibilities

• Own and manage third‑party risk management program and vendor lifecycle risk assessments.
• Partner with Security, Legal, Compliance, IT, and business stakeholders to identify and mitigate risks.
• Review reports (SOC 1/2, ISO 27001) and privacy materials for compliance evidence.
• Interface with auditors, vendors, and stakeholders to gather documentation and respond to requests.
• Support responses to third‑party questionnaires and keep risk records organized.
• Prepare risk summaries, dashboards, and governance materials for leadership.

Skills

Vendor risk assessments

Cross-functional collaboration

Risk communication

Audit readiness

Education

Bachelor's degree in Business Information Systems, Cybersecurity, Risk Management, Compliance, or related field

Tools

Drata

Job description

Pinnacle Group, Inc. seeks an experienced professional to own and manage the third‑party risk management program, coordinating with Information Security, Legal, Compliance, IT, and business stakeholders to address technology, cybersecurity, privacy, AI, and vendor risks.

You will review SOC 1/2, ISO 27001, and related reports, maintain risk documentation, and support audit readiness. The role focuses on ensuring accurate, complete, and well‑documented risk governance across vendors.