Third Party GRC Analyst

Hamlyn Williams Ltd.; California; On-site; USD 100,000 - 125,000; Full time

Job summary

A staffing and recruiting firm seeks a Third Party GRC Analyst to manage vendor risk and enhance GRC initiatives within a security-first culture. Candidates should have over 3 years of experience in Third Party Risk Management and GRC in a regulated enterprise. The role offers remote-first flexibility, but ideally requires candidates based in specific California locations. Competitive compensation ranges from $100,000 to $125,000.

Qualifications

• 3+ years of hands-on experience in Third Party Risk Management and GRC.
• Strong knowledge of security and privacy frameworks.
• Highly organized and proactive in a dynamic environment.

Responsibilities

• Guide vendors through the entire lifecycle — from onboarding to offboarding.
• Manage third-party risk assessments to evaluate privacy and security risks.
• Contribute to client compliance efforts, including assessments and documentation.

Skills

Third Party Risk Management

GRC

Regulatory requirements

Security frameworks

Clear communication skills

Job description

Overview

This range is provided by Hamlyn Williams. Your actual pay will be based on your skills and experience — talk with your recruiter to learn more.

We are partnered with one of our enterprise highly regulated clients who is looking for a Third Party GRC Analyst to join a high-performing Information Security team and drive meaningful impact across Third Party Risk Management (TPRM), Client Compliance, and IT Risk Management.

In this role you’ll be actively shaping and executing processes that keep the organization secure, compliant, and resilient. You\'ll collaborate across functions and play a key role in managing vendor risk, supporting client compliance requests, and enhancing GRC initiatives with continuous improvement and automation in mind.

What You’ll Do

• Partner closely with the TPRM Manager to guide vendors through the entire lifecycle — from onboarding to offboarding.
• Lead and support third-party risk assessments to uncover and evaluate potential privacy and security risks.
• Manage the collection and analysis of due diligence documentation (SOC reports, SIG questionnaires, security policies, etc.).
• Evaluate vendor cybersecurity controls across hardware, software, and services in alignment with internal risk standards.
• Collaborate with stakeholders and vendors to track remediation efforts and mitigate identified risks.
• Contribute to client compliance efforts, including assessments, documentation, and client engagement.
• Apply frameworks such as NIST CSF, ISO, GDPR, and CCPA to drive consistent, comprehensive evaluations.
• Support contractual security review efforts in partnership with Procurement and Legal.
• Continuously improve GRC practices, identifying automation opportunities and contributing to long-term program maturity.

What You Bring

• 3+ years of hands-on experience in Third Party Risk Management and GRC within a Big 4 firm or highly regulated enterprise (e.g., financial services, healthcare, legal).
• Deep understanding of the TPRM lifecycle and GRC principles.
• Strong knowledge of security and privacy frameworks (e.g., NIST, ISO) and regulatory requirements (e.g., GDPR, CCPA).
• Highly organized, proactive, and able to work autonomously in a dynamic environment.
• Clear and confident communication skills with the ability to engage both technical and non-technical audiences.

Why This Role Stands Out

• You’ll be embedded in a security-first culture that values risk intelligence, collaboration, and innovation.
• You’ll work across departments and with clients, making your work visible and impactful.
• You’ll have the chance to shape and improve GRC processes with a mindset toward automation and efficiency.
• Remote-first flexibility, with preference for those based in Century City, Los Angeles, Orange County, Palo Alto, San Diego, or San Francisco to align with team operations.

Compensation: $100,000 – $125,000

No VISA sponsorship offered for this role. Candidates must be GC holders or US Citizens.

Seniority level

• Associate

Employment type

• Full-time

Job function

• Information Technology

Industries

• Staffing and Recruiting

Referrals increase your chances of interviewing at Hamlyn Williams by 2x