Information Security Third-Party Risk Analyst

Responsibilities

• Perform information security risk assessments on third-party vendors (new and existing)
• Review and analyze vendor security questionnaires, control responses, and supporting documentation
• Identify security gaps, control deficiencies, and non-compliance issues
• Document and track risk findings and remediation efforts through resolution
• Evaluate vendor remediation plans and compensating controls
• Partner with business stakeholders and third parties to explain risks and recommend mitigation strategies
• Support contract review and redlining with a focus on information security requirements
• Conduct continuous monitoring of vendor security posture
• Review and assess third‑party security incidents and perform post‑event analysis
• Contribute to monthly and quarterly reporting, metrics, and trend analysis
• Support audit activities, control testing, and quality assurance efforts
• Collaborate across information security, risk, and compliance teams

• 5+ years of experience in information security
• 5+ years of experience in third-party risk management, vendor risk, or risk analysis
• Hands‑on experience conducting third-party/vendor information security risk assessments
• Strong understanding of information security controls and risk concepts
• Experience identifying control gaps and evaluating remediation actions
• Experience with contract review or redlining related to security requirements
• Ability to clearly communicate risk to both technical and non‑technical stakeholders