Third-Party Security Risk Analyst

Devoted Health Services, Inc; Waltham (MA); On-site; USD 58,000 - 110,000; Full time

Benefits offered by this job

Health plan

Generous PTO and stipend

Stock options

Bonus eligibility

401K program

Job summary

Devoted Health is seeking a Third-Party Security Risk Analyst to support our GRC program. You will assess vendors, document risks, and help ensure partnerships remain secure while contributing to AI-enabled automation within vendor risk processes.

You will collaborate with Legal, Procurement, Compliance, and ERM to execute the full TPRM lifecycle from onboarding to offboarding, focusing on HIPAA/HITRUST considerations and contractual security controls.

Qualifications

• Hands-on experience in third-party risk management or vendor management.
• Familiarity with risk frameworks (e.g., NIST CSF, ISO 27001, SOC 2).
• Experience reviewing security questionnaires, SOC reports, and evidence.

Responsibilities

• Onboard and reassess third-party vendors under Security purview and document risks.
• Perform initial impact assessments and tiering for vendors based on criteria.
• Conduct risk assessments and review security documentation for vendors.
• Track assessment status and follow up with owners to ensure timely submissions.
• Document risk findings including inherent and residual risk scores.
• Monitor remediation actions and escalate overdue items.
• Assist with contract review to verify required Infosec addendum clauses.
• Support program documentation, procedures, and guidelines.

Skills

Third-party risk management

Vendor management

Information security

Compliance

Audit

Data privacy

Analytical skills

Cross-functional collaboration

Education

Bachelor's degree in risk management or related

Job description

Job Description A bit about this role

Are you looking to build your career in cybersecurity while making a real difference for the members who depend on us? Our Cybersecurity Governance, Risk Management, and Compliance (GRC) team is looking for a Third-Party Security Risk Analyst to help run the day-to-day work of our Third-Party Risk Management (TPRM) program. You'll work alongside senior team members to assess our vendors, document risk, and keep our partnerships secure. It's hands-on work that directly shapes how safely we operate.

Your Responsibilities and Impact

• Support the onboarding and reassessment of third-party vendors under the Security purview. You'll gather information, document risks, facilitate stakeholder discussions, evaluate inherent and residual risk, and track follow-up actions and remediation activities.
• Impact Assessments & Tiering: Perform initial impact assessments on new and existing vendors and assign risk tiers using established criteria, such as data classification, system access, criticality to operations, and regulatory exposure. The tier sets the level and cadence of due diligence each vendor requires.
• Risk Assessments: Carry out standardized third-party risk assessments under the direction of senior team members, including reviewing security questionnaires, SOC reports, and supporting evidence.
• Assessment Tracking: Track assessment status and follow up with risk domain owners so submissions arrive on time.
• Risk Documentation: Document risk findings and ratings, including inherent and residual risk scores, clearly and consistently.
• Remediation Follow-Up: Monitor open findings and remediation commitments, and elevate overdue items.
• Contract Support: Help verify that vendor contracts include the required Infosec addendum clauses.
• Program Documentation: Help maintain procedures, templates, and guidelines so the program stays organized and repeatable.
• Audit Support: Support internal and external audits of the vendor risk program by preparing evidence and responding to requests.
• Innovation: Support efforts to improve AI-enabled automation into the vendor risk program.
• Emerging AI Risk: Help evaluate AI usage in vendors’ products and services, including how they protect data, manage model and platform risk, and meet contractual and regulatory expectations.
• At the Heart of It You'll execute the full TPRM lifecycle, from initial vendor assessments through ongoing monitoring and offboarding. Along the way you'll help third-party services join our ecosystem without compromising our security or our values.

Why Step Into This Role

This role is a strong foundation for a career in cybersecurity GRC. You'll get direct mentorship from experienced TPRM and security professionals and exposure to Legal, Procurement, Compliance, and ERM. You'll also get the chance to grow your skills while contributing to Devoted's resilience against cybersecurity threats.

Required skills and experience

• Practical experience in third-party risk management, vendor management, procurement, information security, compliance, or audit (relevant internships count)
• Basic understanding of third-party risk concepts, governance policies, and common security frameworks (e.g., HITRUST, NIST CSF, ISO 27001, ISO 42001, SOC 2)
• Exposure to vendor lifecycle procedures, including onboarding, ongoing monitoring, and offboarding
• Exposure to contract clause review for security, privacy, and business resilience controls
• Familiarity with findings or vulnerability remediation tracking
• Awareness of software and hardware supply chain risk
• Strong analytical skills with the ability to interpret data and spot gaps or inconsistencies in vendor responses
• Excellent organizational skills and attention to detail, with the ability to manage multiple assessments at once
• Strong written and verbal communication skills
• Comfort working cross-functionally with Legal, Finance, Risk, Procurement, and business stakeholders

Desired skills and experience

• Bachelor's degree in risk management, information security, privacy, compliance, business, or a related discipline
• 3-5 years of experience in a third-party risk management role, including vendor management
• Familiarity with cloud security controls and shared responsibility models across major providers (e.g., AWS, Azure, GCP), including how to evaluate a vendor's cloud environment during an assessment
• Awareness of AI-related risks and controls, such as data usage and retention, model transparency, and responsible AI practices, and of emerging frameworks like the NIST AI Risk Management Framework or ISO/IEC 42001
• Knowledge of healthcare regulations such as HIPAA and HITRUST
• Relevant certifications, or progress toward them (e.g., CISA, CIA)

Salary Range

Salary Range: $58,000 - $110,000/year The pay range listed for this position is the range the organization reasonably and in good faith expects to pay for this position at the time of the posting. Once the interview process begins, your talent partner will provide additional information on the compensation for the role, along with additional information on our total rewards package. The actual base salary offered will depend on a variety of factors, including the qualifications of the individual applicant for the position, years of relevant experience, specific and unique skills, level of education attained, certifications or other professional licenses held, and the location in which the applicant lives and/or from which they will be performing the job.

Total Rewards Package

• Employer sponsored health, dental and vision plan with low or no premium
• Generous paid time off $100 monthly mobile or internet stipend
• Stock options for all employees
• Bonus eligibility for all roles excluding Director and above; Commission eligibility for Sales roles
• Parental leave program 401K program
• And more....
• Our total rewards package is for full time employees only. Intern and Contract positions are not eligible.

Company Overview

Founded in 2017, Devoted Health is on a mission to dramatically improve the health and well-being of older Americans by caring for everyone like they are family, and that includes our employees. Our robust and seamlessly integrated care platform merges advanced data and AI access with world-class clinical and service experiences to create a member experience that is unlike the industry norm. To continue building upon our mission, we want to bring together those who share our values, embrace change and advancement, and are enthusiastic about where we're going - all the while bringing their own unique qualities, experiences, and expertise, in hopes of further changing the healthcare experience.

Diversity and Inclusion

Devoted is an equal opportunity employer. We are committed to a safe and supportive work environment in which all employees have the opportunity to participate and contribute to the success of the business. We value diversity and collaboration. Individuals are respected for their skills, experience, and unique perspectives. This commitment is embodied in Devoted’s Code of Conduct, our company values and the way we do business. As an Equal Opportunity Employer, the Company does not discriminate on the basis of race, color, religion, sex, pregnancy status, marital status, national origin, disability, age, sexual orientation, veteran status, genetic information, gender identity, gender expression, or any other factor prohibited by law.

Our management team is dedicated to this policy with respect to recruitment, hiring, placement, promotion, transfer, training, compensation, benefits, employee activities and general treatment during employment.