Vendor Security Risk & GRC Analyst

Devoted Health Services; United States; Sur place; USD 58 000 - 110 000; Plein temps

Résumé du poste

Devoted Health Services is seeking a Third-Party Security Risk Analyst to run the day-to-day TPRM program. You will assess vendors, document risk, and track remediation actions, collaborating with Legal, Procurement, and Risk stakeholders.

You will perform initial risk tiering, conduct assessments, monitor findings, and help ensure contracts include required security clauses while supporting audits and AI-risk initiatives.

Qualifications

• Experience in third-party risk management, vendor management, procurement, information security, compliance, or audit.
• Understanding of governance policies and frameworks (e.g., HITRUST, NIST CSF, ISO 27001).
• Familiarity with vendor lifecycle (onboarding, monitoring, offboarding).
• Ability to review security or privacy contract clauses.
• Strong analytical, organizational, and communication skills.
• Willingness to work cross-functionally.

Responsabilités

• Support onboarding and reassessment of third-party vendors under Security purview.
• Perform initial impact assessments and risk tiering.
• Carry out third-party risk assessments and review SOC reports.
• Track assessment status and follow up with owners.
• Document risk findings and remediation actions.
• Support contract review and program documentation.
• Assist audits and explore AI risk and automation improvements.

Connaissances

Third-party risk management

Vendor management

Information security

Compliance

Audit

GRC

Contract review

Data analysis

Cross-functional collaboration

Communication

Formation

Bachelor's degree in risk management, information security, privacy, or related field

Description du poste

Devoted Health Services is seeking a Third-Party Security Risk Analyst to run the day-to-day TPRM program. You will assess vendors, document risk, and track remediation actions, collaborating with Legal, Procurement, and Risk stakeholders.

You will perform initial risk tiering, conduct assessments, monitor findings, and help ensure contracts include required security clauses while supporting audits and AI-risk initiatives.