Third-Party Ecosystem Risk Analyst

Plaid; San Francisco (CA); On-site; USD 119,000 - 176,000; Full time

Benefits offered by this job

Equity

Medical, dental, vision benefits

401(k)

Competitive compensation

Job summary

Plaid in San Francisco is seeking a Security Risk Assessor to run vendor risk assessments end-to-end and vet the security posture of customers and partners onboarding to the platform.

You will mature the third-party risk lifecycle, implement AI-assisted workflows, and report program health to stakeholders. If you bring 4+ years of vendor risk experience and practical knowledge of SOC 2, ISO 27001, and NIST CSF, join Plaid to help protect data across a broad ecosystem.

Qualifications

• 4+ years of experience in vendor risk management.
• Experience running security risk assessments of third parties and translating them into defensible risk ratings.
• Working knowledge of SOC 2, ISO 27001, NIST CSF and common control domains.
• Ability to mature a third-party risk program with improved questionnaires and workflow.
• Strong written and verbal communication across cross-functional teams.

Responsibilities

• Run Vendor Security Risk Assessments end-to-end: intake, questionnaire, risk rating, findings and exceptions.
• Vet Customer and Partner Security Posture onboarding to the platform.
• Keep the Third-Party Risk Lifecycle current: tiering, reassessments, remediation and risk register.
• Mature the program: improve questionnaires, tiering, intake, and tooling as volume grows.
• Report on ecosystem risk to Security and stakeholders; leverage AI to raise throughput.

Skills

Vendor risk management

Security risk assessments

SOC 2 / ISO 27001 knowledge

NIST CSF knowledge

AI tooling for risk

Tools

OneTrust

ProcessUnity

Whistic

SecurityScorecard

Job description

Plaid in San Francisco is seeking a Security Risk Assessor to run vendor risk assessments end-to-end and vet the security posture of customers and partners onboarding to the platform.

You will mature the third-party risk lifecycle, implement AI-assisted workflows, and report program health to stakeholders. If you bring 4+ years of vendor risk experience and practical knowledge of SOC 2, ISO 27001, and NIST CSF, join Plaid to help protect data across a broad ecosystem.