TPRM Security Analyst: Ecosystem Risk

Plaid Inc; New York (NY); On-site; USD 120,000 - 180,000; Full time

Job summary

Plaid Inc. is seeking an experienced security risk professional to lead end-to-end vendor risk assessments and manage the third-party risk lifecycle.

You will evaluate security postures of customers, vendors, and partners onboarding to Plaid’s platform, ensuring high standards, data protection, and regulatory alignment. In this role, you’ll scale reviews through improved questionnaires, tiering, and runbooks, while partnering with Procurement, Legal, and GTM.

Qualifications

• 4+ years of experience in vendor risk management.
• Experience running security risk assessments of third parties—reviewing questionnaires, SOC 2 and ISO reports, and security documentation, and translating them into a defensible risk rating.
• Familiarity with the third-party risk lifecycle: intake, tiering, exceptions and risk acceptance, remediation tracking, and periodic reassessment.
• Working knowledge of SOC 2, ISO 27001, NIST CSF, and common control domains (access control, encryption, incident response, BC/DR).
• Experience maturing a third-party or vendor risk program—improving how it works (tiering criteria, questionnaires, workflow, automation).
• Clear written and verbal communication—able to explain a security risk to Procurement, Legal, or a customer.

Responsibilities

• Run Vendor Security Risk Assessments: triage inbound vendor requests, scale reviews to risk tier, rate risk, and document findings and exceptions.
• Vet Customer and Partner Security Posture: review security practices of customers and partners onboarding to the platform.
• Keep the Third-Party Risk Lifecycle Current: maintain risk tiering, drive reassessments, chase remediation to closure, keep the risk register accurate.
• Mature the Program: improve questionnaires, tiering criteria, intake, and runbooks, and tooling as review volume grows.
• Report on Ecosystem Risk: track cycle times, backlog, open exceptions, and provide program health updates to stakeholders.
• Scale Through AI and Tooling: build AI-assisted workflows for assessment review, questionnaire analysis, and reporting.

Skills

Vendor risk management

Security risk assessment

SOC 2

ISO 27001

NIST CSF

Communication

AI tooling

Tools

OneTrust

Job description

Plaid Inc. is seeking an experienced security risk professional to lead end-to-end vendor risk assessments and manage the third-party risk lifecycle.

You will evaluate security postures of customers, vendors, and partners onboarding to Plaid’s platform, ensuring high standards, data protection, and regulatory alignment. In this role, you’ll scale reviews through improved questionnaires, tiering, and runbooks, while partnering with Procurement, Legal, and GTM.