Third-Party Risk Analyst - Vendor Security Assessments

The Elite Job; Centerport (NY); On-site; USD 110,000 - 140,000; Full time

Job summary

The Elite Job is seeking a detail-oriented Third-Party Risk Analyst – Vendor Security Assessments to strengthen our vendor risk program. You will evaluate third-party security controls, review questionnaires, and identify gaps, working with security, procurement, legal, and compliance teams to ensure alignment with regulatory requirements and organizational risk tolerance.

You will lead assessments, document findings, and help mature our risk framework through remediation tracking, reporting,

Qualifications

• Bachelor's degree in cybersecurity, information technology, computer science, information systems, risk management or related field preferred.
• Equivalent professional experience or industry certifications may be considered.
• Training in information security governance, risk assessment, privacy, or regulatory compliance is advantageous.

Responsibilities

• Conduct vendor security assessments of third‑party vendors, suppliers, and service providers.
• Review security questionnaires and supporting evidence to determine control effectiveness.
• Identify control gaps and provide remediation recommendations based on risk severity.
• Prepare clear risk assessment reports and dashboards for stakeholders.
• Collaborate with procurement, legal, compliance, security, and business teams to ensure requirements are met.
• Support governance, risk, and compliance activities across programs.

Skills

Vendor risk management

Security questionnaires

Risk assessment

Documentation

Education

Bachelor's degree in Cybersecurity/IT/CS

Tools

GRC platforms

Vendor risk software

Microsoft Excel

Office 365

Job description

1. Job Summary

The Elite Job is seeking a detail-oriented and analytical Third-Party Risk Analyst – Vendor Security Assessments to support the organizations information security, vendor risk management, and regulatory compliance initiatives. The successful candidate will be responsible for evaluating the security posture of third-party vendors, suppliers, service providers, and business partners to identify potential risks associated with their access to company systems, confidential information, and critical business operations. In this role, you will conduct vendor security assessments, review security questionnaires, analyze supporting documentation, evaluate cybersecurity controls, and identify gaps that could expose the organization to data breaches, operational disruptions, compliance violations, or other security incidents. You will collaborate with information security teams, procurement professionals, legal representatives, compliance specialists, and business stakeholders to ensure that third-party relationships meet established security standards and organizational risk requirements. The ideal candidate combines a strong understanding of cybersecurity principles with excellent analytical, communication, and documentation skills. You should be comfortable assessing technical and non-technical risks, interpreting security evidence, prioritizing findings, and recommending practical remediation measures. This position offers an opportunity to contribute to a proactive security culture while helping the organization maintain trusted vendor relationships and strengthen its overall risk management framework.

2. Key Responsibilities

Vendor Security Assessments

• Conduct initial, periodic, and event-driven security assessments of third-party vendors, suppliers, contractors, and service providers.
• Evaluate vendor security questionnaires, risk assessment forms, and supporting evidence to determine whether appropriate security controls are implemented.
• Assess vendors based on their access to sensitive information, business criticality, data processing activities, and potential impact on organizational operations.
• Review vendor security documentation, including security policies, incident response procedures, business continuity plans, and access control standards.
• Evaluate vendors' ability to protect confidential information and maintain the integrity, availability, and confidentiality of business systems.

Cybersecurity Risk Identification and Analysis

• Identify potential vulnerabilities, security control deficiencies, and weaknesses in third-party technology environments and operational processes.
• Assess risks related to data protection, identity and access management, encryption, network security, vulnerability management, and incident response.
• Review evidence of independent security assessments, including relevant SOC 2 reports, ISO/IEC 27001 certifications, penetration test summaries, and other assurance documentation.
• Evaluate risks associated with cloud service providers, software vendors, managed service providers, and organizations that process sensitive business or customer information.
• Assign risk ratings using established assessment criteria and recommend mitigation strategies based on risk severity and business impact.
• Escalate critical findings, unresolved control deficiencies, and significant vendor security concerns to the appropriate stakeholders.

Risk Reporting and Documentation

• Maintain accurate and complete records of vendor assessments, identified risks, supporting evidence, remediation plans, and approval decisions.
• Prepare clear assessment reports summarizing security findings, control gaps, residual risks, and recommended corrective actions.
• Develop risk summaries and dashboards to communicate vendor risk exposure, assessment progress, and outstanding remediation activities.
• Maintain a centralized inventory of assessed vendors, their risk classifications, assessment dates, and review requirements.
• Ensure that assessment documentation is organized, traceable, and available for internal audits and compliance reviews.

Risk Remediation and Monitoring

• Work with vendors and internal stakeholders to establish remediation plans for identified security weaknesses.
• Track corrective actions, monitor remediation deadlines, and verify evidence that agreed-upon controls have been implemented.
• Conduct follow-up assessments to confirm that significant security issues have been resolved.
• Monitor relevant changes in vendor ownership, technology platforms, security incidents, and service delivery arrangements that may affect risk exposure.
• Support ongoing monitoring processes for high-risk vendors and recommend reassessments when material changes occur.
• Help establish consistent escalation procedures for overdue remediation activities and unacceptable residual risks.

Governance, Risk, and Compliance

• Support the development and maintenance of third-party risk management policies, procedures, assessment templates, and control frameworks.
• Help align vendor assessments with applicable regulatory obligations, contractual security requirements, and recognized industry standards.
• Support compliance activities involving frameworks such as NIST Cybersecurity Framework, ISO/IEC 27001, SOC 2, GDPR, and other relevant requirements, where applicable.
• Collaborate with procurement and legal teams to incorporate appropriate security requirements into vendor onboarding, contracts, and renewals.
• Participate in internal audits, risk committee discussions, vendor reviews, and security governance meetings.
• Recommend improvements to assessment workflows, reporting processes, and risk management procedures.

Stakeholder Collaboration

• Build effective working relationships with procurement, IT, cybersecurity, legal, privacy, compliance, and business operations teams.
• Communicate security findings in language that both technical teams and business stakeholders can understand.
• Respond to vendor inquiries regarding security assessments, evidence requirements, and remediation expectations.
• Provide guidance to internal teams on vendor security risks and appropriate risk mitigation options.
• Contribute to security awareness initiatives that promote responsible third-party risk management practices.

3. Required Skills and Qualifications

Educational Qualifications

Bachelors degree in Cybersecurity, Information Technology, Computer Science, Information Systems, Risk Management, or a related discipline is preferred. Equivalent professional experience, relevant technical training, or industry-recognized certifications may also be considered. Additional training in information security governance, risk assessment, privacy, or regulatory compliance is advantageous.

Technical Skills

• Strong understanding of cybersecurity fundamentals, including access management, encryption, vulnerability management, network security, and data protection.
• Knowledge of third-party risk management processes, vendor due diligence, security questionnaires, and control assessments.
• Familiarity with security assurance documentation, including SOC 2 reports, ISO/IEC 27001 certifications, and penetration testing reports.
• Understanding of information security policies, risk registers, control testing, and remediation tracking.
• Ability to evaluate security evidence, identify control gaps, and distinguish between documented policies and demonstrated control effectiveness.
• Familiarity with cloud security concepts and risks associated with SaaS, IaaS, and outsourced technology services.
• Working knowledge of governance, risk, and compliance principles and commonly used cybersecurity frameworks.
• Proficiency in Microsoft Excel, Word, PowerPoint, and other tools used for assessment documentation and reporting.
• Experience with GRC platforms, vendor risk management software, ticketing systems, or risk tracking tools is beneficial.

Analytical and Problem-Solving Skills

• Strong analytical thinking and the ability to assess complex information systematically.
• Ability to identify patterns, evaluate risk severity, and prioritize findings according to business impact.
• Attention to detail when reviewing security questionnaires, audit reports, policies, and technical evidence.
• Sound judgment when determining whether vendor security controls adequately address identified risks.
• Ability to translate technical security findings into actionable recommendations.
• A structured approach to investigation, documentation, and problem resolution.

Communication and Interpersonal Skills

• Excellent written and verbal communication skills.
• Ability to prepare clear, professional risk assessment reports and management summaries.
• Confidence in communicating with vendors and internal stakeholders to clarify findings and obtain supporting evidence.
• Strong organizational skills and the ability to manage multiple assessments simultaneously.
• Professionalism when handling confidential information and sensitive business discussions.
• Ability to work independently while contributing effectively to a collaborative team.

4. Experience

• Previous experience in third-party risk management, vendor security assessments, cybersecurity governance, IT auditing, information security, or GRC is preferred.
• Experience reviewing vendor questionnaires, security certifications, audit reports, and control evidence is highly desirable.
• Practical experience identifying security gaps, documenting risks, and tracking remediation actions is an advantage.
• Familiarity with vendor onboarding, due diligence, contract security reviews, or ongoing supplier monitoring is beneficial.
• Experience working with regulated industries, cloud service providers, financial services organizations, healthcare providers, or enterprise technology environments is an added advantage.
• Candidates with relevant cybersecurity knowledge and transferable analytical skills may be considered for junior-level opportunities, depending on business needs.
• The level of responsibility will depend on the candidates qualifications, professional experience, and demonstrated ability to conduct independent assessments.

5. Working Hours

Employment Schedule: Full-time, subject to the agreed employment arrangement.

Typical Working Hours: Approximately 40 hours per week, depending on location, contract terms, and business requirements.

Work Arrangement: Remote, hybrid, or office-based, depending on the position offered.

Flexibility: Some flexibility may be available to accommodate vendor meetings across different time zones.

Collaboration: Participation in scheduled team meetings, risk reviews, vendor discussions, and stakeholder updates may be required.

Additional Hours: Occasional additional hours may be necessary during major audits, critical vendor assessments, or urgent risk escalations.

The final working schedule, time zone, and employment terms will be communicated during the recruitment process.

6. Knowledge, Skills, and Abilities

Knowledge

• Understanding of third-party risk management lifecycle activities, including vendor identification, due diligence, assessment, risk treatment, and continuous monitoring.
• Knowledge of common cybersecurity risks associated with external service providers and outsourced business operations.
• Understanding of information security controls, data classification, privacy principles, and secure information handling.
• Familiarity with recognized security standards and frameworks, including NIST guidance, ISO/IEC 27001, and SOC 2 assurance practices.
• Awareness of relevant privacy and regulatory requirements, depending on the organizations industry and operating locations.
• Understanding of business continuity, disaster recovery, incident response, and supplier resilience considerations.

Skills

• Vendor assessment and security evidence analysis.
• Cybersecurity risk identification, evaluation, and prioritization.
• Risk register maintenance and remediation tracking.
• Report writing, documentation, and presentation preparation.
• Stakeholder coordination and professional vendor communication.
• Process improvement and assessment workflow management.
• Microsoft Office and digital collaboration tools.
• Time management, organization, and workload prioritization.

Abilities

• Ability to assess security risks objectively using documented criteria and available evidence.
• Ability to manage several vendor assessments while meeting established deadlines.
• Ability to recognize incomplete, inconsistent, or insufficient security documentation and request clarification.
• Ability to communicate complex risks clearly to technical and non-technical audiences.
• Ability to handle confidential vendor information responsibly and follow appropriate access restrictions.
• Ability to work independently, exercise sound judgment, and escalated material risks when necessary.
• Ability to adapt to changing cybersecurity threats, vendor environments, and compliance expectations.
• Ability to maintain accurate records and support continuous improvement in third-party risk management.

7. Benefits

• The Elite Job aims to provide a professional and supportive working environment. Depending on the employment arrangement, location, and applicable company policies, potential benefits may include:
• Competitive Compensation: Salary aligned with the roles responsibilities, experience, qualifications, and relevant market conditions.
• Remote or Hybrid Work Opportunities: Flexible work arrangements where the position and business requirements permit.
• Professional Development: Opportunities to strengthen expertise in vendor risk management, cybersecurity governance, and compliance.
• Certification Support: Potential access to relevant training or professional certification assistance, subject to company policy.
• Career Development: Opportunities to develop skills in information security, risk management, internal audit, and cybersecurity governance.
• Collaborative Environment: Opportunities to work with professionals across technology, procurement, legal, privacy, and compliance functions.
• Performance Recognition: Recognition for quality assessments, effective risk reduction, process improvements, and professional contributions.
• Work-Life Balance: Clear work expectations and reasonable workload planning, where supported by the employment arrangement.
• Specific compensation, insurance, leave entitlements, equipment provisions, and other benefits will be confirmed in the official employment offer. These benefits should not be considered guaranteed unless expressly included in the applicable offer or company policy.

8. Why Join The Elite Job?

You will have the opportunity to:

• Make a Meaningful Security Impact: Help identify and reduce risks that could affect sensitive information, business systems, and organizational reputation.
• Develop Specialized Expertise: Build practical knowledge of third-party cybersecurity assessments, control frameworks, vendor due diligence, and risk remediation.
• Collaborate Across Business Functions: Work with professionals from security, technology, procurement, legal, compliance, and business operations.
• Strengthen Analytical Capabilities: Gain experience evaluating security evidence, assessing risk, and developing practical recommendations.
• Contribute to Process Improvement: Help improve assessment templates, reporting practices, monitoring activities, and risk governance procedures.
• Build a Long-Term Career: Develop a foundation for future opportunities in vendor risk management, cybersecurity governance, IT audit, GRC, or information security leadership.
• The role is suited to professionals who value accuracy, accountability, continuous learning, and a proactive approach to security risk management.