Third-Party Security Risk Analyst

Devoted Health Services; United States; On-site; USD 58,000 - 110,000; Full time

Job summary

Devoted Health Services is seeking a Third-Party Security Risk Analyst to run the day-to-day TPRM program. You will assess vendors, document risk, and track remediation actions, collaborating with Legal, Procurement, and Risk stakeholders.

You will perform initial risk tiering, conduct assessments, monitor findings, and help ensure contracts include required security clauses while supporting audits and AI-risk initiatives.

Qualifications

• Experience in third-party risk management, vendor management, procurement, information security, compliance, or audit.
• Understanding of governance policies and frameworks (e.g., HITRUST, NIST CSF, ISO 27001).
• Familiarity with vendor lifecycle (onboarding, monitoring, offboarding).
• Ability to review security or privacy contract clauses.
• Strong analytical, organizational, and communication skills.
• Willingness to work cross-functionally.

Responsibilities

• Support onboarding and reassessment of third-party vendors under Security purview.
• Perform initial impact assessments and risk tiering.
• Carry out third-party risk assessments and review SOC reports.
• Track assessment status and follow up with owners.
• Document risk findings and remediation actions.
• Support contract review and program documentation.
• Assist audits and explore AI risk and automation improvements.

Skills

Third-party risk management

Vendor management

Information security

Compliance

Audit

GRC

Contract review

Data analysis

Cross-functional collaboration

Communication

Education

Bachelor's degree in risk management, information security, privacy, or related field

Job description

Job Description

A bit about this role

Are you looking to build your career in cybersecurity while making a real difference for the members who depend on us? Our Cybersecurity Governance, Risk Management, and Compliance (GRC) team is looking for a Third-Party Security Risk Analyst to help run the day-to-day work of our Third-Party Risk Management (TPRM) program. You'll work alongside senior team members to assess our vendors, document risk, and keep our partnerships secure. It's hands-on work that directly shapes how safely we operate.

Your Responsibilities and Impact will include:

• Support the onboarding and reassessment of third-party vendors under the Security purview. You'll gather information, document risks, facilitate stakeholder discussions, evaluate inherent and residual risk, and track follow-up actions and remediation activities.
• Impact Assessments & Tiering: Perform initial impact assessments on new and existing vendors and assign risk tiers using established criteria, such as data classification, system access, criticality to operations, and regulatory exposure. The tier sets the level and cadence of due diligence each vendor requires.
• Risk Assessments: Carry out standardized third-party risk assessments under the direction of senior team members, including reviewing security questionnaires, SOC reports, and supporting evidence.
• Assessment Tracking: Track assessment status and follow up with risk domain owners so submissions arrive on time.
• Risk Documentation: Document risk findings and ratings, including inherent and residual risk scores, clearly and consistently.
• Remediation Follow-Up: Monitor open findings and remediation commitments, and prioritize overdue items.
• Contract Support: Help verify that vendor contracts include the required Infosec addendum clauses.
• Program Documentation: Help maintain procedures, templates, and guidelines so the program stays organized and repeatable.
• Audit Support: Support internal and external audits of the vendor risk program by preparing evidence and responding to requests.
• Innovation: Support efforts to improve AI-enabled automation into the vendor risk program.
• Emerging AI Risk: Help evaluate AI usage in vendors' products and services, including how they protect data, manage model and platform risk, and meet contractual and regulatory expectations.

At the Heart of It

You'll execute the full TPRM lifecycle, from initial vendor assessments through ongoing monitoring and offboarding. Along the way you'll help third-party services join our ecosystem without compromising our security or our values.

Why Step Into This Role

This role is a strong foundation for a career in cybersecurity GRC. You'll get direct mentorship from experienced TPRM and security professionals and exposure to Legal, Procurement, Compliance, and ERM. You'll also get the chance to grow your skills while contributing to Devoted's resilience against cybersecurity threats.

Required skills and experience:

• Practical experience in third-party risk management, vendor management, procurement, information security, compliance, or audit (relevant internships count)
• Basic understanding of third-party risk concepts, governance policies, and common security frameworks (e.g., HITRUST, NIST CSF, ISO 27001, ISO 42001, SOC 2)
• Exposure to vendor lifecycle procedures, including onboarding, ongoing monitoring, and offboarding
• Exposure to contract clause review for security, privacy, and business resilience controls
• Familiarity with findings or vulnerability remediation tracking
• Awareness of software and hardware supply chain risk
• Strong analytical skills with the ability to interpret data and spot gaps or inconsistencies in vendor responses
• Excellent organizational skills and attention to detail, with the ability to manage multiple assessments at once
• Strong written and verbal communication skills
• Comfort working cross-functionally with Legal, Finance, Risk, Procurement, and business stakeholders

Desired skills and experience:

• Bachelor's degree in risk management, information security, privacy, compliance, business, or a related discipline
• 3-5 years of experience in a third-party risk management role, including vendor management
• Familiarity with cloud security controls and shared responsibility models across major providers (e.g., AWS, Azure, GCP), including how to evaluate a vendor's cloud environment during an assessment
• Awareness of AI-related risks and controls, such as data usage and retention, model transparency, and responsible AI practices, and of emerging frameworks like the NIST AI Risk Management Framework or ISO/IEC 42001
• Knowledge of healthcare regulations such as HIPAA and HITRUST
• Relevant certifications, or progress toward them (e.g., CISA, CIA)

Salary Range: $58,000 - $110,000/year

Once the interview process begins, your talent partner