Third-Party Risk Management Analyst

Role overview

Manage security risk across a vendor and partner ecosystem as part of a governance, risk, and compliance function. The role owns third-party security assessments from initial risk tiering and onboarding through recurring reviews and remediation, helping ensure that external relationships meet established security standards. Success depends on coordinating security work across Legal, Procurement, and system owners throughout the business.

Responsibilities

- Conduct and manage security risk assessments for critical vendors and business partners. - Oversee the full third-party risk lifecycle, including risk tiering, onboarding, reassessment, and remediation. - Evaluate whether vendor relationships satisfy applicable internal security expectations. - Track identified issues and coordinate remediation activities with responsible stakeholders. - Partner with Legal, Procurement, and system owners to support informed vendor decisions. - Maintain clear communication and documentation throughout the assessment process.

Requirements

- Experience in third-party risk management, information security, governance, risk, or compliance. - Understanding of vendor security assessments and risk-based review processes. - Ability to manage multiple assessments and remediation activities across stakeholders. - Strong written and verbal communication skills for working with business and control partners. - Organized, detail-oriented approach to documenting risk decisions and follow-up actions.

Benefits and work setup

- Remote position for eligible candidates residing in the United States, with specified metropolitan-area exclusions. - The work connects security risk management with operational relationships that support essential industries and services.