Third-Party Cyber Risk Analyst

North Mark Strategies is a leading investment firm, combining capital, innovation, and engineering to drive long-term value. From operating complex businesses to backing breakthrough technologies, our mission is to build enduring businesses. Our team combines intelligent risk‑taking, operational excellence, exceptional talent, and world‑class computing capacity to create shareholder value.

Our company offers a dynamic environment where individuals have the freedom to lead companies toward bold achievements by embracing innovation, leveraging technology, and fostering differentiated business strategies. Our values are Integrity, Ability, and Energy, and the company aims to hire individuals who possess those qualities.

At North Mark Strategies, we believe the future isn’t something to hope for, it’s something to build. We don’t just invest, we create. Bringing together strategic insight and technical horsepower to deliver outcomes that endure.

The Third-Party Cyber Risk Analyst will join the global effort in driving North Mark Strategies' Third‑Party Cyber Security Risk Management program in identifying, assessing, and managing risks to North Mark Strategies and associated Enterprise companies. As a member of the IT Risk and Compliance team and part of the Office of the CISO, this role will be critical in maturing the current Third‑Party risk program and creating/building new processes as part of an effort to grow our security maturity across our portfolio of companies.

The ideal candidate is a proven thought leader, problem solver, and integrator of people and processes, as well as an effective internal consultant who is comfortable leveraging AI‑assisted tooling to deliver faster, higher‑quality vendor assessments. Reporting to the Manager of Third‑Party Risk Management, this role will work alongside the broader Technology and Security teams to assess and quantify the risk presented by third parties in use across the group.

This includes, but is not limited to, pre‑contract cyber diligence for portfolio company vendor and third‑party relationships, risk identification, and mitigation planning based on third‑party risk profile.

To be successful in this role, you will need to be a self‑starter, ready to dig into new vendors and third parties, thorough in your evaluation of their security posture, and able to clearly convey any risks to both technical and non‑technical stakeholders. You should be equally comfortable scrutinizing a SOC 2 report, interrogating a vendor’s AI sub processor chain, and using AI‑assisted platforms to accelerate questionnaire review and artifact analysis.

This role will be responsible for identifying, evaluating, and reporting on third‑party information security risks across the portfolio, and will work with our portfolio companies to assess their third‑party risks, communicate those risks, and on an ongoing basis perform risk assessments of new vendors and third parties requested by the business.

• Lead risk/security assessments of suppliers and Third Parties to identify, validate, and remediate Cybersecurity Risks. Plan, coordinate, and lead assessments of Third Parties against North Mark’s security framework and industry security standards.
• Analyze a vendor’s threat model at intake to scope a tightly focused review, tying the business use case to the risks it introduces, and the controls needed to mitigate them with a focus on identifying the true nature of the risk.
• Conduct privacy‑focused reviews of vendor data handling practices, including DPA terms, sub‑processor disclosures, international data transfer mechanisms, and alignment with applicable privacy regulations.
• Perform targeted assessments of vendor AI capabilities — including AI subprocessor chains, model training data practices, data retention and deletion commitments, and governance around enterprise vs. consumer AI tiers — and translate those findings into clear recommendations for the business.
• Leverage AI‑assisted TPRM platforms (e.g., Lema) and large language model to accelerate questionnaire review, artifact analysis, and report drafting, while applying sound analytical judgment to…