Third-Party Security Risk Analyst

Jobgether; United States; Remote; USD 58,000 - 110,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Paid time off

Mobile stipend

Stock options

Bonus eligibility

401(k)

Parental leave

Comprehensive package

Job summary

Jobgether is seeking a Vendor Risk Manager in the United States to oversee onboarding, reassessment, monitoring, and offboarding of third-party vendors. The role includes conducting risk assessments, reviewing security documentation, and tracking remediation and audits.

Collaboration with Legal, Finance, Risk, Procurement, and Compliance is essential. The ideal candidate has 3–5 years of experience in vendor risk management, familiarity with HITRUST, NIST, ISO, SOC 2, and cloud security controls

Qualifications

• Strong analytical skills to interpret findings and identify gaps.
• Excellent organizational skills with attention to detail and deadlines.
• Clear written and verbal communication across stakeholders.
• Ability to work cross-functionally with Legal, Finance, Risk, Procurement, Compliance, and business teams.

Responsibilities

• Support onboarding, reassessment, monitoring, and offboarding of third-party vendors.
• Conduct initial vendor risk assessments and assign risk tiers.
• Review security questionnaires, SOC reports, and other docs for risk assessments.
• Evaluate inherent and residual risks and document findings.
• Track assessment progress with risk domain owners and ensure deadlines.
• Monitor vendor security findings and remediation plans; escalate overdue actions.
• Assist with contract reviews to ensure information security clauses are included.
• Maintain and improve TPRM policies, procedures, and templates.
• Assist audits by preparing supporting docs and responding to requests.
• Contribute to AI-enabled automation to improve efficiency of vendor risk activities.
• Assess AI-related risks including data usage, model security, and governance.

Skills

Analytical skills

Organizational skills

Written and verbal communication

Cross-functional collaboration

Education

Bachelor's degree in Risk Management or related field

Job description

Accountabilities:

• Support the onboarding, reassessment, ongoing monitoring, and offboarding of third-party vendors, ensuring compliance with established security requirements.
• Conduct initial vendor impact assessments and assign appropriate risk tiers based on data sensitivity, system access, operational criticality, and regulatory exposure.
• Perform standardized third-party security risk assessments by reviewing security questionnaires, SOC reports, and other supporting documentation under the guidance of senior team members.
• Evaluate inherent and residual risks, document findings and risk ratings, and ensure assessment records are accurate and consistent.
• Coordinate with internal stakeholders and risk domain owners to track assessment progress, obtain outstanding documentation, and meet deadlines.
• Monitor vendor security findings, remediation plans, and outstanding commitments, escalating overdue actions when necessary.
• Support contract reviews by verifying that required information security and risk-related clauses are included in vendor agreements.
• Maintain and improve TPRM policies, procedures, templates, and guidelines to ensure consistent and repeatable processes.
• Assist with internal and external audits by preparing supporting documentation and responding to evidence requests.
• Contribute to the implementation of AI-enabled automation initiatives designed to improve the efficiency of vendor risk management activities.
• Assess emerging AI-related risks associated with third-party products and services, including data protection, model security, platform risks, and compliance with contractual and regulatory requirements.

Requirements:

• Practical experience in third-party risk management, vendor management, procurement, information security, compliance, or auditing. Relevant internships and early-career experience are also considered.
• Basic understanding of third-party risk management principles, governance policies, and recognized security frameworks, such as HITRUST, NIST Cybersecurity Framework, ISO 27001, ISO 42001, and SOC 2.
• Familiarity with vendor lifecycle management processes, including onboarding, ongoing monitoring, reassessment, and offboarding.
• Exposure to reviewing contractual requirements related to information security, data privacy, and business resilience.
• Understanding of security findings, vulnerability management, and remediation tracking processes.
• Awareness of software and hardware supply chain security risks.
• Strong analytical skills, with the ability to interpret information, evaluate vendor responses, and identify inconsistencies or potential security gaps.
• Excellent organizational skills and attention to detail, with the ability to manage multiple assessments and deadlines simultaneously.
• Strong written and verbal communication skills, including the ability to document findings clearly and collaborate effectively with different stakeholders.
• Ability to work cross-functionally with Legal, Finance, Risk, Procurement, Compliance, and business teams.
• A bachelor's degree in Risk Management, Information Security, Privacy, Compliance, Business, or a related field is preferred.
• Ideally, 3-5 years of experience in third-party risk management or vendor management.
• Familiarity with cloud security controls and shared responsibility models across major cloud providers, including AWS, Azure, and Google Cloud Platform.
• Awareness of AI-related security and governance risks, including data usage and retention, model transparency, and responsible AI practices, as well as emerging standards such as the NIST AI Risk Management Framework and ISO/IEC 42001.
• Knowledge of healthcare security and privacy regulations, particularly HIPAA and HITRUST, is an advantage.
• Relevant professional certifications, or progress toward obtaining them, such as CISA or CIA, are desirable.

Benefits:

• Competitive annual salary: $58,000-$110,000, depending on experience, qualifications, certifications, skills, and work location.
• Employer-sponsored health, dental, and vision insurance plans, with low or no employee premiums.
• Generous paid time off.
• Monthly $100 mobile phone or internet stipend.
• Stock options available to all employees.
• Bonus eligibility for most roles, excluding Director-level positions and above.
• Commission eligibility for Sales positions.
• Parental leave program.
• 401(k) retirement savings program.
• Additional benefits and rewards as part of the comprehensive employee package.