Third-Party Risk Analyst

Role Overview

We are looking for a Third-Party Risk Analyst acts as a critical line of defense protecting data and operational integrity. The role executes end-to-end risk assessments across the entire vendor lifecycle — from onboarding and contract review through continuous monitoring and offboarding. This is a hands-on assessment role embedded in the Compliance & GRC function, working daily with Procurement, Legal, and business owners across the enterprise.

\nKey Responsibilities

• Risk assessments: Execute comprehensive due diligence reviews on new and existing vendors using specialized questionnaires, architecture diagrams, and data-flow assessments.
• Documentation review: Analyze third-party audit reports and security certifications, including SOC 1, SOC 2, and ISO 27001, to identify security weaknesses or compliance gaps.
• Regulatory compliance: Monitor and ensure vendor alignment with privacy regulations and framework criteria such as PCI DSS, SOX, HIPAA, and GLBA.
• Contract and SLA tracking: Partner with Procurement and Legal to review contract language, integrate required security clauses, and track vendor performance against Service Level Agreements (SLAs).
• Issue remediation: Coordinate with business owners and external vendors to build remediation roadmaps, track open security items, and validate corrective evidence before closing risk exceptions.
• Reporting and metrics: Maintain the centralized Governance, Risk, and Compliance (GRC) platform inventory, updating risk dashboards and compiling status reports for executive committees and auditors.

Requirements

• Third-Party Risk Management (TPRM)
• Information Security Auditing
• IT Compliance
• SOC 1 Report Analysis
• SOC 2 Report Analysis
• ISO 27001 Report Analysis
• Analytical Skills
• Technical Literacy
• Data Flow Interpretation
• System Configuration Analysis
• GRC Platforms
• Vendor Risk Indexing Tools
• UpGuard
• OneTrust
• SecurityScorecard
• Bitsight
• Stakeholder Management
• Written Communication
• Verbal Communication
• English

Preferred Skills

• PCI DSS Compliance
• SOX Compliance
• HIPAA Compliance
• GLBA Compliance
• Contract Review
• Vendor Inventory Management
• Executive Dashboard Management
• CTPRP Certification
• CISA Certification

Qualifications

• At least 2 years of dedicated experience in Third-Party Risk Management (TPRM), information security auditing, or IT compliance
• Ability to read and interpret SOC 1, SOC 2, and ISO 27001 reports and translate findings into actionable risk language
• Sharp analytical skills and strong technical literacy, including the ability to interpret data flows and system configurations
• Hands-on experience with GRC platforms and vendor risk indexing tools (e.g., UpGuard, OneTrust, SecurityScorecard, or Bitsight)
• Exceptional cross-functional stakeholder management — comfortable holding vendors and internal owners to commitments
• Excellent written and verbal communication skills in English
• Experience supporting PCI DSS, SOX, HIPAA, or GLBA compliance programs at retail or multi-brand scale (preferred)
• Prior exposure to contract review in partnership with Procurement and Legal (preferred)
• Experience maintaining a vendor inventory and executive-level risk dashboards (preferred)
• Bachelor's degree in Information Technology, Cybersecurity, Management Information Systems, Business Administration, Finance, or a related discipline — or equivalent hands-on experience
• CTPRP (Certified Third-Party Risk Professional) or CISA (Certified Information Systems Auditor) strongly preferred

\n