Third-Party Ecosystem Security Analyst

Plaid; New York (NY); On-site; USD 140,000 - 200,000; Full time

Job summary

Plaid, with offices in New York, seeks a Security Risk professional to run third-party risk assessments end-to-end—from intake and questionnaire through risk rating, findings, and tracked exceptions. You will vet vendors, customers, and partners onboarding to the platform to ensure data protection.

Responsibilities include keeping the risk lifecycle current with tiering, reassessments, remediation closure, and a live risk register; maturing runbooks and tooling; and reporting program health to

Qualifications

• Must have 4+ years in vendor risk management.
• Experience running security risk assessments of third parties; translate into defensible risk ratings.
• Knowledge of SOC 2, ISO 27001, NIST CSF and related control domains.
• Ability to communicate risk clearly to Procurement, Legal, and GTM teams.
• Experience maturing a third-party risk program with tiering, questionnaires, and automation.

Responsibilities

• RunVendor Security Risk Assessments for inbound requests and tiered risk reviews.
• Vet Customer and Partner Security Posture onboarding to the Plaid platform.
• Keep the Third-Party Risk Lifecycle current with cadence-driven reassessments and remediation tracking.
• Mature the program by improving questionnaires, tiering criteria, and runbooks.
• Report on ecosystem risk and program health to Security and cross-functional stakeholders.
• Scale through AI-enabled workflows for assessment review and reporting.

Skills

Vendor risk management

Security risk assessment

SOC 2, ISO 27001, NIST CSF

Cross-functional communication

AI tooling for reviews

Tools

OneTrust

ProcessUnity

Whistic

SecurityScorecard

AI tooling

Job description

Plaid, with offices in New York, seeks a Security Risk professional to run third-party risk assessments end-to-end—from intake and questionnaire through risk rating, findings, and tracked exceptions. You will vet vendors, customers, and partners onboarding to the platform to ensure data protection.

Responsibilities include keeping the risk lifecycle current with tiering, reassessments, remediation closure, and a live risk register; maturing runbooks and tooling; and reporting program health to