Vendor Security & Risk Analyst

Hogan Lovells; Louisville (KY); On-site; USD 121,000 - 146,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

401(k) retirement plan

Paid time off

Job summary

Hogan Lovells Cadwalader is seeking a Vendor Security Analyst to evaluate third party risk and oversee vendor engagements, including security questionnaires and regulatory compliance. The role reports to the Head of Information Risk.

The ideal candidate will assess risk, conduct onsite vendor audits, maintain a risk repository, and influence control improvements across high‑risk suppliers and partners. Washington, DC-based requirements may apply.

Qualifications

• Strong and demonstrated information security risk identification (including Cloud services), assessment, and risk ranking experience.
• Working experience with risk assessment documents such as SIG questionnaires, penetration tests, vulnerability tests, SOC 1/2 Type 2, and ISO 27001.

Responsibilities

• Evaluate third party risk and steer vendor relationships.
• Evaluate vendor responses to security questionnaires.
• Make recommendations on mitigating vendor risk.
• Maintain vendor risk repository with artifacts and risk scores.
• Conduct onsite audits of high risk vendors for security and controls.
• Support Responsible Business initiatives and firm commitments.

Skills

Risk Identification

Risk Assessment

Vendor relations

Technical concepts

Decision making

Detail orientation

Risk management

Education

Bachelor's degree preferred

Tools

SOC 1/2 Type 2

ISO 27001

SIG questionnaire

Penetration testing

Vulnerability testing

Job description

Hogan Lovells Cadwalader is seeking a Vendor Security Analyst to evaluate third party risk and oversee vendor engagements, including security questionnaires and regulatory compliance. The role reports to the Head of Information Risk.

The ideal candidate will assess risk, conduct onsite vendor audits, maintain a risk repository, and influence control improvements across high‑risk suppliers and partners. Washington, DC-based requirements may apply.