Job Summary
Job Title Security GRC Analyst - Third Party Risk Management (TPRM) L2 Role Summary The Security GRC TPRM L2 Analyst is responsible for managing and performing comprehensive third-party security risk assessments, evaluating vendor security postures, and ensuring alignment with organizational security, regulatory, and compliance requirements. The role acts as a subject matter expert for third-party risk assessments, supports audit and compliance initiatives, drives risk remediation, and mentors junior analysts within the TPRM program.
Key Responsibilities
Key Responsibilities Third-Party Risk Management • Conduct detailed security assessments of third-party vendors, suppliers, and business partners. • Review vendor security questionnaires, audit reports, certifications, and control evidence. • Evaluate vendor security controls against internal standards and industry frameworks. • Perform inherent and residual risk assessments for new and existing vendors. • Recommend risk treatment plans and compensating controls. Risk Analysis & Remediation • Identify, assess, and document security, privacy, operational, compliance, and technology risks. • Collaborate with vendors and internal stakeholders to develop remediation plans. • Track and validate remediation activities until closure. • Escalate critical and high-risk findings to management and risk committees. • Support risk acceptance and exception management processes.
Skill Requirements
Technical & Security Skills • Strong understanding of Information Security principles and risk management practices. • Experience conducting third-party/vendor security assessments. • Knowledge of: o Cloud Security (Azure, AWS, GCP) o Identity & Access Management o Network Security o Data Protection & Encryption o Vulnerability Management o Incident Response • Ability to review SOC 1/SOC 2 reports, ISO certifications, penetration test reports, and security architecture documents.