TPRM & Vendor Security Risk Lead

Turo Inc.; San Francisco (CA); Hybrid; USD 131,000 - 164,000; Full time

Benefits offered by this job

Employer-paid medical/dental/vision

401(k) match

Learning & Development stipend

Turo host matching program

Travel credit

Cell phone stipend

Paid time off

Paid holidays & parental leave

In-office lunch & snacks

Job summary

Turo Inc. is seeking a Senior Vendor Security Risk Analyst to own the third‑party risk management program and drive security awareness and access review campaigns.

You will assess vendor risk end‑to‑end, build scalable review processes, and partner with Procurement, Legal, and Privacy to integrate security into onboarding and renewals. The role requires 5+ years in vendor risk or GRC, hands‑on SOC 2/ISO experience, and cloud security knowledge.

Qualifications

• 5+ years in third‑party risk management, vendor security, or GRC.
• Hands‑on experience evaluating SOC 2, ISO, pen-tests, and translating findings into risk recommendations.
• Familiarity with DPAs & MSAs and working with Legal and Procurement.

Responsibilities

• Own vendor security review lifecycle: intake, risk tiering, due diligence, findings, remediation, renewals.
• Evaluate vendor evidence and deliver clear risk recommendations.
• Review contracts from a security perspective and provide approval recommendations.
• Design scalable tiering, intake workflows, and continuous monitoring for growing vendor volume.
• Collaborate with Procurement, Legal, and Privacy to integrate security reviews into onboarding/renewals.
• Create and maintain external security questionnaires and trust-center content.
• Partner on security awareness training programs including phishing and data handling.
• Coordinate quarterly user access review campaigns and remediation of access exceptions.
• Report KPIs to security leadership on cycle time, findings, aging, and completion.

Skills

Vendor risk management

SOC 2 & ISO assessments

Contract review (DPAs & MSAs)

Cloud security (AWS)

IAM & data protection

Security training development

GRC tooling (Vanta/Drata/ZenGRC)

Security awareness programs

Education

Bachelor’s degree in Computer Science or Information Security

Tools

Vanta

Drata

ZenGRC

Job description

Turo Inc. is seeking a Senior Vendor Security Risk Analyst to own the third‑party risk management program and drive security awareness and access review campaigns.

You will assess vendor risk end‑to‑end, build scalable review processes, and partner with Procurement, Legal, and Privacy to integrate security into onboarding and renewals. The role requires 5+ years in vendor risk or GRC, hands‑on SOC 2/ISO experience, and cloud security knowledge.