Vendor Cyber Risk Analyst

Selby Jennings; New York (NY); On-site; USD 90,000 - 140,000; Full time

Job summary

Selby Jennings is seeking an Information Security & Third-Party Risk Analyst to oversee vendor and external partner risk across the organization. The role evaluates cybersecurity posture of suppliers and service providers supporting business operations.

You will partner with risk, technology, legal, compliance and procurement teams to ensure third-party relationships meet security standards and regulatory expectations.

Qualifications

• Experience with technology, cybersecurity, or vendor risk assessments.
• Knowledge of the third-party risk management lifecycle.
• Familiarity with NIST, ISO 27001, CRI Profile frameworks.
• Experience reviewing SOC 1 and SOC 2 reports.
• Understanding of information security principles including access management, continuity, incident response, data protection.

Responsibilities

• Evaluate cybersecurity risks in third-party relationships.
• Analyze security artifacts and reports (SOC, audits, BCPs, policies).
• Identify control gaps and assign risk ratings.
• Support onboarding, contracts, renewals, and terminations from a security risk perspective.
• Monitor ongoing third-party cybersecurity developments and incidents.
• Maintain records in risk management systems and complete risk reviews.
• Collaborate to track remediation and risk mitigation activities.
• Assist regulatory examinations and governance initiatives.
• Contribute to improving risk management procedures and standards.

Skills

Vendor risk assessments

Cybersecurity risk analysis

Risk management lifecycle

Analytical skills

Communication skills

Regulated industry experience

Tools

Third-party risk platforms

Workflow tools

Job description

Selby Jennings is seeking an Information Security & Third-Party Risk Analyst to oversee vendor and external partner risk across the organization. The role evaluates cybersecurity posture of suppliers and service providers supporting business operations.

You will partner with risk, technology, legal, compliance and procurement teams to ensure third-party relationships meet security standards and regulatory expectations.