Senior Third-Party Risk Management Analyst

<h3>Accountabilities</h3><li>Maintain the enterprise-wide inventory of third-party providers, applications, and services throughout their lifecycle, from onboarding through termination.</li><li>Lead and coordinate vendor cybersecurity assessments, partnering with cybersecurity, legal, procurement, and business stakeholders to identify risks and required controls.</li><li>Evaluate vendor maturity against frameworks and requirements including NIST CSF, CIS, CMMC, GDPR, PCI DSS, and SOC 2.</li><li>Review vendor service-level agreements, RPO/RTO commitments, breach notification requirements, cybersecurity insurance, and other risk-related obligations.</li><li>Document assessment findings, recommendations, remediation plans, exceptions, and compensating controls, ensuring risks are tracked through resolution.</li><li>Support internal and external audits by providing evidence and validating third-party controls related to SOC 2 Type II, PCI DSS, and broader compliance requirements.</li><li>Maintain audit-ready policies, standards, procedures, risk treatment plans, and supporting documentation in collaboration with GRC stakeholders.</li><li>Partner with Threat &amp; Vulnerability Management teams on client vulnerability notifications, ensuring communications are accurate, timely, and aligned with contractual and industry requirements.</li><li>Provide consultative guidance to clients and internal stakeholders regarding risk impact, remediation expectations, and recommended cybersecurity practices.</li><li>Contribute to the continuous improvement of the information security management system by aligning third-party risk processes with organizational policies, standards, and procedures.</li><li>Support control selection, risk treatment planning, cybersecurity metrics, and initiatives designed to measure and improve control effectiveness.</li><li>Monitor emerging cybersecurity threats, regulatory developments, and industry trends that may affect third-party risk and organizational resilience.</li><li>Support disaster recovery and business continuity planning related to vendor dependencies and resilience requirements.</li><li>Act as a trusted point of contact for business units managing vendor-related risks and coordinate risk reduction strategies across legal, cybersecurity, and leadership teams.</li><li>Promote cybersecurity awareness through outreach, training, documentation, and knowledge-sharing initiatives.</li><li>Mentor colleagues and contribute to internal training materials, process documentation, and the continued maturity of the third-party risk program.</li><h2>Requirements</h2><li>5+ years of professional experience in cybersecurity, third-party risk management, risk management, audit, compliance, or a closely related discipline.</li><li>Strong knowledge of regulatory and compliance requirements, including PCI DSS, SOC 2, GDPR, GLBA, HIPAA, SOX, and HITRUST.</li><li>Demonstrated experience evaluating both legacy environments and modern cloud technologies, including AWS, GCP, and Azure.</li><li>Strong understanding of APIs, application security, encryption, endpoint security, and network security concepts.</li><li>Familiarity with SIEM, intrusion detection systems, log management, vulnerability management, and threat intelligence.</li><li>Proven ability to assess vendor controls, map controls to recognized security frameworks, identify gaps, and clearly communicate risk to technical and non-technical stakeholders.</li><li>Experience supporting SOC 2 Type II and PCI DSS audits is highly valuable.</li><li>Familiarity with eGRC or ITGRC platforms such as Jira Service Management GRC, Archer, OneTrust, or LogicGate is preferred.</li><li>Professional certifications such as CISSP, CISM, CISA, CRISC, CTPRA, or CTPRP are desirable.</li><li>Strong project management, organizational, prioritization, and multitasking skills, with the ability to manage multiple vendor assessments and compliance activities simultaneously.</li><li>Excellent written and verbal communication skills, including the ability to translate complex cybersecurity topics into clear, actionable guidance.</li><li>Strong stakeholder-management skills and the ability to collaborate effectively across cybersecurity, legal, procurement, product, client success, and executive teams.</li><li>A proactive, analytical, and consultative approach to identifying risk and developing practical solutions.</li><li>Strong professionalism, empathy, and customer-service orientation when working with both internal and external stakeholders.</li><li>Ability to work remotely and independently while maintaining strong collaboration and accountability.</li><li>Candidates must be authorized to work in the United States without sponsorship.</li><h2>Benefits</h2><li>Medical, dental, and vision benefits.</li><li>401(k) savings plan with company matching.</li><li>Flexible planned paid time off.</li><li>Generous sick leave.</li><li>Employer-paid parental leave.</li><li>Employer-paid short-term disability coverage.</li><li>Remote work flexibility.</li><li>Strong emphasis on work-life balance.</li><li>Inclusive and welcoming work environment.</li><li>Purpose-driven culture focused on creating meaningful impact.</li><li>Opportunities to contribute to community-focused initiatives.</li><li>Collaborative environment with an emphasis on innovation, professional growth, and employee engagement.</li>