Vendor Risk & Security Analyst

Hogan Lovells; Washington, Northern (District of Columbia, KY); Hybrid; USD 121,000 - 146,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401(k) retirement plan

Paid time off

Job summary

Hogan Lovells Cadwalader seeks a Vendor Security Analyst to evaluate third-party risk, review security responses, and mitigate risk while maintaining a vendor risk repository. The role includes onsite audits of high-risk vendors and supporting the firm’s Responsible Business initiatives.

The position reports to the Head of Information Risk and offers base compensation with potential discretionary bonuses. Core hours follow a standard 37.5-hour workweek in Washington, DC.

Qualifications

• Strong information security risk identification, assessment and ranking experience.
• Experience with risk assessment documents: SIG questionnaire, penetration tests, vulnerability tests, SOC 1 & 2 Type 2, ISO 27001.
• Bachelor's degree preferred.

Responsibilities

• Evaluate third-party risk and steer vendor relationships.
• Assess vendor responses to security questionnaires.
• Recommend mitigations for vendor risk.
• Maintain vendor risk repository and assign risk scores.
• Conduct onsite audits of high-risk vendors for security controls.
• Support Responsible Business initiatives and firm commitments.
• Assist with emerging priorities as needed.

Skills

Risk assessment

Technical concepts

Independent decision making

Communication

Attention to detail

Risk management

Education

Bachelor's degree preferred

Job description

Hogan Lovells Cadwalader seeks a Vendor Security Analyst to evaluate third-party risk, review security responses, and mitigate risk while maintaining a vendor risk repository. The role includes onsite audits of high-risk vendors and supporting the firm’s Responsible Business initiatives.

The position reports to the Head of Information Risk and offers base compensation with potential discretionary bonuses. Core hours follow a standard 37.5-hour workweek in Washington, DC.