Third-Party Security Risk Analyst

Job Description A bit about this role Are you looking to build your career in cybersecurity while making a real difference for the members who depend on us? Our Cybersecurity Governance, Risk Management, and Compliance (GRC) team is looking for a Third-Party Security Risk Analyst to help run the day-to-day work of our Third-Party Risk Management (TPRM) program. You'll work alongside senior team members to assess our vendors, document risk, and keep our partnerships secure. It's hands-on work that directly shapes how safely we operate. Your Responsibilities and Impact will include: Support the onboarding and reassessment of third-party vendors under the Security purview. You'll gather information, document risks, facilitate stakeholder discussions, evaluate inherent and residual risk, and track follow-up actions and remediation activities. Impact Assessments & Tiering: Perform initial impact assessments on new and existing vendors and assign risk tiers using established criteria, such as data classification, system access, criticality to operations, and regulatory exposure. The tier sets the level and cadence of due diligence each vendor requires. Risk Assessments: Carry out standardized third-party risk assessments under the direction of senior team members, including reviewing security questionnaires, SOC reports, and supporting evidence. Assessment Tracking: Track assessment status and follow up with risk domain owners so submissions arrive on time. Risk Documentation: