Vendor Risk & Security Analyst (TPRM)

Devoted Health; United States; À distance; USD 58 000 - 110 000; Plein temps

Avantages offerts par ce poste

Health, dental & vision coverage

Monthly stipend for mobile/internet

Stock options

Bonus eligibility across roles

Parental leave

401K

Résumé du poste

Devoted Health is seeking a Third-Party Security Risk Analyst to join its Cybersecurity GRC team in the United States. You will manage onboarding, ongoing risk assessments, and documentation for vendor relationships, ensuring controls meet regulatory expectations and internal standards.

You will perform tiering, risk scoring, and remediation tracking, collaborating with Legal, Procurement, and Risk teams. A background in risk management and security frameworks is needed to support audits and

Qualifications

• Practical experience in third-party risk management, vendor management, procurement, information security, compliance, or audit (relevant internships count)
• Basic understanding of third-party risk concepts, governance policies, and common security frameworks (e.g., HITRUST, NIST CSF, ISO 27001, ISO 42001, SOC 2)
• Exposure to vendor lifecycle procedures (onboarding, monitoring, offboarding)
• Exposure to contract clause review for security, privacy, and business resilience controls
• Familiarity with findings or vulnerability remediation tracking
• Awareness of software and hardware supply chain risk
• Strong analytical skills to interpret data and identify gaps in vendor responses
• Excellent organizational skills and ability to manage multiple assessments

Responsabilités

• Onboard and reassess third-party vendors under Security purview, document risks and remediation actions
• Perform initial impact assessments and assign risk tiers based on data classification, criticality, and regulatory exposure
• Carry out standardized third-party risk assessments including reviewing security questionnaires and SOC reports
• Track assessment status and follow up with risk domain owners
• Document risk findings and scores clearly (inherent and residual)
• Monitor open findings and elevated overdue remediation
• Help verify vendor contracts include Infosec addendum clauses
• Maintain procedures, templates, and guidelines for repeatable processes
• Support audits by preparing evidence and responding to requests
• Assist in implementing AI-enabled automation in the vendor risk program
• Evaluate AI usage in vendors’ products for data protection and regulatory alignment
• Execute full TPRM lifecycle from assessment to monitoring and offboarding

Connaissances

Third-Party Risk Mgmt

Vendor Management

Information Security

Compliance & Regulation

Risk Assessment

Analytical Skills

Cross-functional Collaboration

Communication

Formation

Bachelor's degree in risk management / information security / privacy / compliance / business

Outils

SOC reports

Security questionnaires

Frameworks: HITRUST / NIST CSF / ISO 27001

Contract clause review

Description du poste

Devoted Health is seeking a Third-Party Security Risk Analyst to join its Cybersecurity GRC team in the United States. You will manage onboarding, ongoing risk assessments, and documentation for vendor relationships, ensuring controls meet regulatory expectations and internal standards.

You will perform tiering, risk scoring, and remediation tracking, collaborating with Legal, Procurement, and Risk teams. A background in risk management and security frameworks is needed to support audits and