Third-Party Risk Analyst

Key Responsibilities

Requirements

• Third-Party Risk Management (TPRM)
• Information Security Auditing
• IT Compliance
• SOC 1 Report Analysis
• SOC 2 Report Analysis
• ISO 27001 Report Analysis
• Analytical Skills
• Technical Literacy
• Data Flow Interpretation
• System Configuration Analysis
• GRC Platforms
• Vendor Risk Indexing Tools
• UpGuard
• OneTrust
• SecurityScorecard
• Bitsight
• Stakeholder Management
• Written Communication
• Verbal Communication
• English
• At least 2 years of dedicated experience in Third-Party Risk Management (TPRM), information security auditing, or IT compliance
• Ability to read and interpret SOC 1, SOC 2, and ISO 27001 reports and translate findings into actionable risk language
• Sharp analytical skills and strong technical literacy, including the ability to interpret data flows and system configurations
• Hands-on experience with GRC platforms and vendor risk indexing tools (e.g., UpGuard, OneTrust, SecurityScorecard, or Bitsight)
• Exceptional cross-functional stakeholder management — comfortable holding vendors and internal owners to commitments
• Excellent written and verbal communication skills in English
• Experience supporting PCI DSS, SOX, HIPAA, or GLBA compliance programs at retail or multi-brand scale (preferred)
• Prior exposure to contract review in partnership with Procurement and Legal (preferred)
• Experience maintaining a vendor inventory and executive-level risk dashboards (preferred)
• Bachelor's degree in Information Technology, Cybersecurity, Management Information Systems, Business Administration, Finance, or a related discipline — or equivalent hands-on experience
• CTPRP (Certified Third-Party Risk Professional) or CISA (Certified Information Systems Auditor) strongly preferred

Preferred Skills