TPRM Analyst

Evolution Cloud Services (EVOCS); United States; On-site; USD 85,000 - 120,000; Full time

Job summary

EVOCS is hiring four TPRM Analysts to join our fast-growing security program. As a TPRM Analyst, you will execute vendor assessments, manage evidence requests, and document findings so readers not on the call can understand exposure.

You will build remediation plans, track closure with vendors and internal owners, maintain audit-ready records, and produce status reports on findings and aging. We value written clarity and data quality.

Qualifications

• 5+ years of experience in cybersecurity, audit, compliance, risk, or vendor management.
• At least 3 years conducting vendor security assessments or third-party reviews.
• Hands-on with security questionnaires, evidence requests, control reviews, and remediation.
• Clear, structured written documentation that can be understood by non-participants.
• Strong focus on data quality and consistency across records.

Responsibilities

• Conduct vendor security assessments and third-party reviews in a high-volume queue.
• Issue and manage security questionnaires, chase evidence requests, and validate what is returned.
• Review control evidence (SOC 2, ISO 27001, penetration test summaries) and document coverage.
• Identify gaps, assign risk ratings, and write findings clearly for readers outside the review.
• Build remediation plans and track actions to closure with vendors and internal owners.
• Maintain audit-ready risk register entries and produce status reporting on aging and findings.

Skills

Vendor security assessment execution

Risk management

Data quality

Written documentation

Communication skills

Independent ownership

Security questionnaires

Control framework familiarity

Tools

SOC 2

ISO 27001

NIST CSF/NIST 800-53

Job description

EVOCS OVERVIEW

EVOCS was founded with a clear purpose: to help businesses operate more effectively, solve complex challenges, and create opportunities for growth through practical expertise and technology solutions.

As an IT consulting firm, we work with our clients to understand their needs, identify the right technologies, and deliver solutions that improve performance and support their business objectives.

Today, EVOCS is a trusted technology partner to a growing number of organizations and industry leaders. Our team combines technical expertise, business understanding, and a commitment to quality to deliver effective solutions and build lasting client relationships based on responsiveness, consistency, and results.

TPRM Analyst

EVOCS Overview

EVOCS's journey began with a mission to empower businesses with advisory expertise, empowered with ideal technologies to provide them with comprehensive solutions to grow and prosper.

Founded by a team of passionate experts, EVOCS has grown into a trusted partner to a growing number of leaders across their respective industries. Our roots in employee-managed operations reflect our commitment to quality, consistency, and client success.

If you enjoy working in a hyper-fast-growing company, are eager to be part of an agile team, and want to be part of our success story, then let's talk!

Role Overview

As a TPRM Analyst, you are the execution layer of the third-party risk program. You carry the assessment volume - questionnaires out, evidence in, controls reviewed, findings documented, remediation tracked - and you keep the work moving without needing someone standing behind you.

Two things make or break this role. The first is written documentation: your assessments and findings are read by people who were not on the call, so they have to stand on their own. The second is data quality. A third-party risk program is only worth what its records say, and inconsistent entries quietly erode the value of everything the program produces. If you are the person who notices that two vendors were tiered differently on the same facts, you will do well here.

We are hiring four TPRM Analysts.

What You Will Do

Assessment Execution

• Conduct vendor security assessments and third-party reviews across a high-volume queue, on schedule and to a consistent standard
• Issue and manage security questionnaires, chase evidence requests, and validate what comes back against what was asked for
• Review control evidence - policies, SOC 2 reports, ISO 27001 certificates, penetration test summaries, and supporting artifacts - and document what the evidence does and does not cover
• Identify gaps and findings, assign risk ratings under the program's tiering criteria, and write them up clearly enough that a reader outside the review understands the exposure
• Escalate complex, contested, or high‑criticality reviews to senior analysts with the work already organized

Remediation and Follow-Through

• Build and track remediation plans with vendors and internal owners, including agreed actions, owners, and due dates
• Chase stakeholders through to closure - vendors, business owners, procurement, and legal - and keep items from aging out quietly
• Re‑validate evidence at remediation closure rather than accepting a status update at face value
• Maintain reassessment schedules for in‑scope vendors and flag material changes between cycles

Records, Reporting, and Data Quality

• Own the accuracy and consistency of your entries in the risk register and TPRM platform: complete fields, correct tiering, current status, and traceable evidence links
• Maintain assessment documentation to an audit‑ready standard
• Produce status reporting on queue volume, aging, findings, and open remediation items
• Flag inconsistencies in criteria application, data entry, or workflow, and help tighten the process that produced them

What You Will Bring

The top candidate will have the following qualifications:

• 5+ years of experience in cybersecurity, audit, compliance, risk, or vendor management
• At least 3 of those years conducting vendor security assessments or third‑party reviews
• Hands‑on comfort with the core mechanics of the role: security questionnaires, evidence requests, control reviews, remediation plans, and risk registers
• Clear, structured written documentation - assessments and findings that hold up when read by someone who was not in the conversation
• Strong attention to data quality and consistency across records, ratings, and documentation
• Ability to drive items to closure independently, following up with vendors and internal stakeholders without being chased yourself
• Working familiarity with common control frameworks such as NIST CSF, NIST 800-53, ISO 27001/27002, or CIS
• Strong interpersonal and communication skills - this role involves frequent interaction with vendors and internal stakeholders via email, calls, and meetings

Key Skills and Competencies

• Vendor security assessment execution
• Contr