The posting
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Third-Party Risk Management Analyst based in United States.
This role is a key contributor to an enterprise-wide cybersecurity, risk, and compliance program, with a strong focus on third-party risk. You will assess vendors, applications, platforms, and service providers against cybersecurity, privacy, resiliency, and regulatory requirements. Working across cybersecurity, legal, procurement, product, client success, and leadership teams, you will turn complex risk findings into practical recommendations. You will support critical compliance programs, including SOC 2 Type II and PCI DSS, while helping maintain audit-ready documentation and controls. The role also contributes to vulnerability communications, business continuity, and continuous improvement of the broader information security management system. This is an opportunity to take meaningful ownership of a growing TPRM program in a collaborative, remote environment.
Accountabilities
- Maintain the enterprise-wide inventory of third-party providers, applications, and services throughout their lifecycle, from onboarding through termination.
- Lead and coordinate vendor cybersecurity assessments, partnering with cybersecurity, legal, procurement, and business stakeholders to identify risks and required controls.
- Evaluate vendor maturity against frameworks and requirements including NIST CSF, CIS, CMMC, GDPR, PCI DSS, and SOC 2.
- Review vendor service-level agreements, RPO/RTO commitments, breach notification requirements, cybersecurity insurance, and other risk-related obligations.
- Document assessment findings, recommendations, remediation plans, exceptions, and compensating controls, ensuring risks are tracked through resolution.
- Support internal and external audits by providing evidence and validating third-party controls related to SOC 2 Type II, PCI DSS, and broader compliance requirements.
- Maintain audit-ready policies, standards, procedures, risk treatment plans, and supporting documentation in collaboration with GRC stakeholders.
- Partner with Threat & Vulnerability Management teams on client vulnerability notifications, ensuring communications are accurate, timely, and aligned with contractual and industry requirements.
- Provide consultative guidance to clients and internal stakeholders regarding risk impact, remediation expectations, and recommended cybersecurity practices.
- Contribute to the continuous improvement of the information security management system by aligning third-party risk processes with organizational policies, standards, and procedures.
- Support control selection, risk treatment planning, cybersecurity metrics, and initiatives designed to measure and improve control effectiveness.
- Monitor emerging cybersecurity threats, regulatory developments, and industry trends that may affect third-party risk and organizational resilience.
- Support disaster recovery and business continuity planning related to vendor dependencies and resilience requirements.
- Act as a trusted point of contact for business units managing vendor-related risks and coordinate risk reduction strategies across legal, cybersecurity, and leadership teams.
- Promote cybersecurity awareness through outreach, training, documentation, and knowledge-sharing initiatives.
- Mentor colleagues and contribute to internal training materials, process documentation, and the continued maturity of the third-party risk program.
- 5+ years of professional experience in cybersecurity, third-party risk management, risk management, audit, compliance, or a closely related discipline.
- Strong knowledge of regulatory and compliance requirements, including PCI DSS, SOC 2, GDPR, GLBA, HIPAA, SOX, and HITRUST.
- Demonstrated experience evaluating both legacy environments and modern cloud technologies, including AWS, GCP, and Azure.
- Strong understanding of APIs, application security, encryption, endpoint security, and network security concepts.
- Familiarity with SIEM, intrusion detection systems, log management, vulnerability management, and threat intelligence.
- Proven ability to assess vendor controls, map controls to recognized security frameworks, identify gaps, and clearly communicate risk to technical and non-technical stakeholders.
- Experience supporting SOC 2 Type II and PCI DSS audits is highly valuable.
- Familiarity with eGRC or ITGRC platforms such as Jira Service Management GRC, Archer, OneTrust, or LogicGate is preferred.
- Professional certifications such as CISSP, CISM, CISA, CRISC, CTPRA, or CTPRP are desirable.
- Strong project management, organizational, prioritization, and multitasking skills, with the ability to manage multiple vendor assessments and compliance activities simultaneously.
- Excellent written and verbal communication skills, including the ability to translate complex cybersecurity topics into clear, actionable guidance.
- Strong stakeholder-management skills and the ability to collaborate effectively across cybersecurity, legal, procurement, product, client success, and executive teams.
- A proactive, analytical, and consultative approach to identifying risk and developing practical solutions.
- Strong professionalism, empathy, and customer-service orientation when working with both internal and external stakeholders.
- Ability to work remotely and independently while maintaining strong collaboration and accountability.
- Candidates must be authorized to work in the United States without sponsorship.
- Medical, dental, and vision benefits.
- 401(k) savings plan with company matching.
- Flexible planned paid time off.
- Generous sick leave.
- Employer-paid parental leave.
- Employer-paid short-term disability coverage.
- Remote work flexibility.
- Strong emphasis on work-life balance.
- Inclusive and welcoming work environment.
- Purpose-driven culture focused on creating meaningful impact.
- Opportunities to contribute to community-focused initiatives.
- Collaborative environment with an emphasis on innovation, professional growth, and employee engagement.
How Jobgether works:
We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.
We appreciate your interest and wish you the best!
Why Apply Through Jobgether?
Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.
#LI-CL1
