Senior Cybersecurity Analyst, Third‑Party Risk
Core
Senior individual contributor owning the Third-Party Risk Management (TPRM) program, setting strategy, validating vendor controls with evidence, and leading incident response coordination.
Role type
Senior IC GRC / Third-Party Risk Manager
Builds
TPRM program, evidence-based assurance frameworks, incident response playbooks, and secure vendor partnerships
Domain
Cybersecurity, Governance, Risk, and Compliance (GRC), Vendor Risk Management
Required skills
TPRM strategy & program design, evidence-based control validation, third-party incident response leadership, contract & SLA security negotiation, risk quantification & prioritization, regulatory & framework expertise
Preferred skills
cloud & SaaS architecture evaluation, tabletop exercise design, executive communication, mentorship
Technologies
SOC 2 Type II, NIST SP 800-61, API security, OAuth, cyber insurance
Responsibilities
Set multi-year TPRM vision and roadmap; own the TPRM lifecycle (intake, tiering, due diligence, offboarding); validate critical vendor controls beyond questionnaires; lead third-party incident response and tabletop exercises; negotiate security terms with Legal/Procurement; mentor analysts and raise TPRM literacy
Seniority
Senior, hands-on IC
