Third-Party Security Risk Analyst — Grow in GRC & AI Risk

Devoted Health Services, Inc; Waltham (MA); On-site; USD 58,000 - 110,000; Full time

Benefits offered by this job

Health plan

Generous PTO and stipend

Stock options

Bonus eligibility

401K program

Job summary

Devoted Health is seeking a Third-Party Security Risk Analyst to support our GRC program. You will assess vendors, document risks, and help ensure partnerships remain secure while contributing to AI-enabled automation within vendor risk processes.

You will collaborate with Legal, Procurement, Compliance, and ERM to execute the full TPRM lifecycle from onboarding to offboarding, focusing on HIPAA/HITRUST considerations and contractual security controls.

Qualifications

• Hands-on experience in third-party risk management or vendor management.
• Familiarity with risk frameworks (e.g., NIST CSF, ISO 27001, SOC 2).
• Experience reviewing security questionnaires, SOC reports, and evidence.

Responsibilities

• Onboard and reassess third-party vendors under Security purview and document risks.
• Perform initial impact assessments and tiering for vendors based on criteria.
• Conduct risk assessments and review security documentation for vendors.
• Track assessment status and follow up with owners to ensure timely submissions.
• Document risk findings including inherent and residual risk scores.
• Monitor remediation actions and escalate overdue items.
• Assist with contract review to verify required Infosec addendum clauses.
• Support program documentation, procedures, and guidelines.

Skills

Third-party risk management

Vendor management

Information security

Compliance

Audit

Data privacy

Analytical skills

Cross-functional collaboration

Education

Bachelor's degree in risk management or related

Job description

Devoted Health is seeking a Third-Party Security Risk Analyst to support our GRC program. You will assess vendors, document risks, and help ensure partnerships remain secure while contributing to AI-enabled automation within vendor risk processes.

You will collaborate with Legal, Procurement, Compliance, and ERM to execute the full TPRM lifecycle from onboarding to offboarding, focusing on HIPAA/HITRUST considerations and contractual security controls.