Vendor Risk Analyst | Third-Party Risk Specialist

Role Overview

Risk Assessment and Oversight

• Conduct vendor risk assessments and due diligence before onboarding third parties.
• Evaluate cybersecurity, data privacy, financial, operational resilience, compliance, and business continuity risks.
• Maintain vendor profiles, ratings, risk registers, documentation, evidence, and approval workflows.
• Identify control gaps and develop risk-mitigation and remediation plans.
• Conduct periodic reassessments of high-risk and critical vendors and maintain risk-based segmentation.

Governance and Monitoring

• Review contracts and provisions covering data protection, information security, continuity, audit rights, and regulatory obligations.
• Coordinate security assessments and review SOC reports, ISO certifications, penetration-test summaries, and continuity plans.
• Track vendor performance, incidents, breaches, service disruptions, ownership changes, and emerging risks.
• Develop dashboards, management reports, KRIs, and performance indicators for third-party risk.
• Support audits, incident investigations, risk response, and process improvements through automation and standardization.

Qualifications

• Bachelor’s degree in Risk Management, Finance, Business Administration, Information Security, Cybersecurity, Compliance, Accounting, or a related field.
• Experience in vendor risk, third-party risk, operational risk, IT risk, compliance, procurement risk, or a similar area.
• Strong knowledge of third-party risk principles, assessment methodologies, risk scoring, treatment, remediation, acceptance, and escalation.
• Experience conducting vendor due diligence, risk assessments, and reviews of security questionnaires and assurance documentation.
• Knowledge of cybersecurity, data privacy, business continuity, operational resilience, and regulatory risks.
• Familiarity with third-party risk frameworks, policies, controls, and governance practices.
• Strong analytical, investigative, communication, stakeholder-management, negotiation, organizational, and documentation skills.
• Strong Microsoft Excel skills and experience preparing risk reports and dashboards.

Preferred Qualifications

• Understanding of ISO 27001, SOC 2, NIST, or similar information-security frameworks is advantageous.
• Familiarity with SOC 1, SOC 2, ISO certifications, penetration-testing reports, and business-continuity documentation is beneficial.
• Experience with vendor-management, GRC, procurement, or risk-management platforms is preferred.
• Knowledge of Power BI, Tableau, or similar reporting tools is advantageous.
• Experience supporting audits, regulatory reviews, or compliance programs is preferred.
• CISA, CRISC, CISM, CISSP, or third-party risk certifications are advantageous.

What We Offer

• Competitive salary and comprehensive employee benefits.
• Professional development and exposure to third-party risk, cybersecurity, compliance, and operational resilience.
• Access to modern GRC, vendor-risk, procurement, and business-intelligence platforms.
• Opportunities to lead vendor-risk assessments and engage in strategic risk decision-making.
• Support for relevant risk, cybersecurity, compliance, and professional certifications.