Third Party Cyber Risk Analyst

Overview

POSITION SUMMARY: The Third Party Cyber Risk Analyst supports and enhances the organization’s Third-Party Risk Management (TPRM) program. This role is responsible for assessing cybersecurity, privacy, operational, and compliance risks associated with vendors and other third parties throughout the vendor's lifecycle. The Analyst partners closely with Information Security, Legal, Procurement, and business stakeholders to evaluate vendor controls, review contract language, monitor risks, and ensure the organization’s standards and regulatory requirements are met prior to onboarding and throughout the duration of the relationship.

This role requires strong analytical skills, the ability to interpret technical and contractual information, and the ability to collaborate with geographically dispersed teams and vendor representatives.

• Conduct risk assessments with a focus on cybersecurity for new and existing vendors.
• Evaluate vendors’ security posture, including access controls, encryption, vulnerability management, incident response, and business continuity practices as well as financial stability.
• Review SOC 1/SOC 2 reports, ISO certifications, penetration test summaries, and security questionnaires.
• Assess risks related to data privacy, cloud environments, and critical system integrations.
• Identify control gaps and recommend practical risk mitigation strategies.
• Perform inherent and residual risk scoring and maintain updated vendor risk profiles.
• Review vendor contracts to ensure appropriate cybersecurity and risk protections are included, such as information security and data protection clauses, breach notification requirements, right-to-audit provisions, business continuity and disaster recovery commitments, subprocessor and fourth-party oversight language, indemnification and liability protections.
• Partner with Legal and Procurement to negotiate risk-aligned contract provisions.
• Ensure contractual obligations align with internal cybersecurity policies and regulatory expectations.
• Maintain vendor risk inventories, exceptions, and remediation plans within the vendor risk management system.
• Track, monitor, and report on open issues, remediation progress, and changes in vendor risk posture.
• Support continuous monitoring activities for critical and high-risk vendors.
• Contribute to the maturity of the TPRM program, including enhancing processes, procedures, workflows, templates, and reporting on third-party cyber risk posture for leadership and risk committees.
• Support updates to TPRM policies, standards, and assessment methodologies.
• Participate in internal projects aimed at improving vendor management practices across the organization.
• Partner with internal teams—including Legal, Procurement, Information Security, and business units—to ensure coordinated and effective vendor risk oversight.
• Communicate assessment results and recommendations to both technical and non-technical stakeholders.
• Build and maintain strong working relationships with internal partners and third-party vendors.
• Other related duties as assigned.

• Bachelor’s Degree in information/data security, business or related field.
• Typically, 5 or more years of related industry experience.
• Experience in information/cyber security risk management, auditing, assessment and/or compliance; as well as related experience in purchasing (RFI/RFP), contracts (review), and project management is preferred.
• Knowledge of industry authoritative sources such as NIST, COBIT, SOC2, CSF, and ISO standards is preferred.
• Experience with TPRM or GRC platforms.

• Strong analytical, risk evaluation, and problem-solving skills.
• Ability to interpret technical controls and contractual language and translate them into business impacts.
• Strong verbal and written communication skills, including the ability to articulate risk to non-technical audiences.
• Ability to manage multiple assignments and deadlines in a fast-paced environment.
• Demonstrated capacity to work independently and lead work processes.
• Strong program management, documentation, and organizational skills.
• Ability to collaborate…