Third-Party & Supply Chain Risk Analyst
Core
Own the day-to-day execution of Third-Party Vendor Risk Management (TPVRM) and Cyber Supply Chain Risk Management (C-SCRM) programs for an aerospace and defense company, assessing suppliers and tracing risk through hardware and software supply chains.
Role type
mid-career Third-Party & Supply Chain Risk Analyst
Builds
vendor risk assessments, supply chain risk controls, HBOM/SBOM inventories, and enterprise risk dashboards
Domain
Aerospace and Defense / Cybersecurity Supply Chain
Required skills
Third-party vendor risk management, Cyber supply chain risk management, NIST SP 800-161, NIST SP 800-171, CMMC, FAIR methodology, OCTAVE, HBOM/SBOM management, Risk quantification, Vendor remediation tracking, Enterprise risk management
Preferred skills
DoD RMF experience, Section 889 compliance, Prohibited-source screening
Technologies
Jira, Confluence, Enterprise GRC platforms, MS Project
Responsibilities
Execute vendor risk assessment lifecycle including intake, tiering, onboarding due diligence, and periodic reassessment; Maintain vendor risk inventory and lifecycle tracking records; Monitor third-party risk signals and escalate material changes; Assess vendor cybersecurity posture against DFARS 252.204-7012, NIST SP 800-171, and CMMC obligations; Build and maintain C-SCRM program tracing risk through hardware and software supply chains; Support sub-tier dependency analysis and concentration risk identification; Support enterprise risk management program design and execution; Build and maintain program dashboards, KPI/KRI reports, and status tracking; Assist with audit readiness activities; Contribute to development of risk policies and standards.
Seniority
Mid-career, hands-on IC
