Vendor Risk Analyst | Third-Party Risk Specialist

About the role

Responsibilities

• Assess vendor risks across cybersecurity, privacy, financial stability, resilience, compliance, and business continuity; maintain profiles, ratings, and risk registers.
• Conduct due diligence and review vendor questionnaires, policies, certifications, financial information, security evidence, and compliance records.
• Identify control gaps, recommend mitigation, track remediation, and reassess critical and high-risk vendors.
• Support vendor segmentation, risk policies, vendor selection, onboarding, and contract reviews; assess contractual security, privacy, continuity, audit, and regulatory provisions.
• Coordinate security assessments and review SOC reports, ISO certifications, penetration-test summaries, continuity plans, and other assurance evidence.
• Monitor vendor performance, incidents, service disruptions, financial and operational indicators, and changes in vendor risk exposure.
• Support third-party incident investigations, risk-response activities, dashboards, KRIs, management reporting, audits, and process improvements.

Requirements

• Bachelor's degree in risk management, finance, business administration, information security, cybersecurity, compliance, accounting, or related field.
• Experience in vendor or third-party risk, operational risk, IT risk, compliance, procurement risk, or a similar role; experience conducting due diligence and risk assessments.
• Strong understanding of third-party risk methods, frameworks, controls, governance, risk scoring, treatment, remediation, acceptance, and escalation.
• Knowledge of cybersecurity, privacy, business continuity, operational resilience, and regulatory risks.
• Experience reviewing vendor security questionnaires and assurance documentation; strong Excel skills and risk reporting experience.
• Strong analytical, investigative, communication, organizational, documentation-review, and stakeholder-management skills; able to manage multiple assessments and deadlines.

Preferred qualifications and tools

• ISO 27001, SOC 2, NIST, or similar standards knowledge is advantageous; familiarity with SOC reports, ISO certifications, penetration-test reports, and continuity documents is beneficial.
• Vendor-management, GRC, procurement, or risk platforms are preferred; Power BI, Tableau, or similar tools are advantageous.
• CISA, CRISC, CISM, CISSP, or third-party risk certifications are advantageous.

What the employer offers

• Competitive salary and comprehensive employee benefits; professional development and support for relevant certifications.
• Exposure to complex third-party ecosystems, enterprise risk programs, modern GRC and business-intelligence platforms, and senior management.
• Opportunities to lead assessments and improvement initiatives, with career progression toward senior analyst, risk manager, or head-of-risk roles.