SR. SECURITY ANALYST, THIRD PARTY RISK MANAGEMENTWe are seeking a mid-to-senior Governance, Risk, and Compliance (GRC) professional focused on third-party risk management (TPRM) to own and scale our vendor risk program as SpaceXSI grows. This role sits at the intersection of cybersecurity GRC, vendor management, and procurement: you will assess the full range of third parties the company depends on - software and SaaS providers, cloud and infrastructure partners, AI model and data providers, professional services firms, and other suppliers - from intake and due diligence through ongoing monitoring and offboarding. The ideal candidate brings a cybersecurity and GRC perspective - fluent in how cloud services, identity and access management, encryption, data flows, and AI/LLM systems actually work in production - and can translate assessment findings into clear, risk-based decisions on residual risk and compensating controls rather than simply documenting issues. You will collaborate across procurement, legal, security, privacy, engineering, and business owners to keep third-party risk clear, proportionate, and actionable across enterprise, commercial, and public-sector environments.
RESPONSIBILITIES:- Own the end-to-end third-party risk lifecycle - intake, inherent risk tiering, due diligence, risk decisioning, contracting support, ongoing monitoring, and offboarding - for vendors and partners across the company
- Design and maintain the risk-tiering methodology and inherent risk questionnaire based on data sensitivity, system and network access, business criticality, and regulatory exposure, so that assessment depth matches actual risk and lower-risk vendors move quickly
- Conduct security, privacy, and business due diligence: issue and review security questionnaires (e.g., SIG, CAIQ, custom assessments), evaluate architecture diagrams and data flows, run follow-up sessions with vendor security teams, and coordinate business checks such as corporate registration, reputational review, and insurance coverage with cross-functional partners
- Critically review independent assurance reports and security documentation, including SOC 1/SOC 2 Type II reports, ISO 27001 and ISO 42001 certificates and Statements of Applicability, penetration test and vulnerability summaries, and bridge letters. Evaluate scope, carve-outs, exceptions, and complementary user entity controls (CUECs) that SpaceXSI must operate
- Translate findings into clear risk decisions: weigh residual risk and compensating controls, recommend approval, conditional approval, or rejection, and document risk exceptions and risk acceptances with clear rationale, owners, and expiration dates
- Partner with Legal and Procurement to define and negotiate contract security terms, including security and data protection exhibits, DPAs, breach notification, right-to-audit, sub-processor clauses, and data retention and deletion requirements, and ensure SpaceXSI's compliance obligations flow down to vendors and sub-processors
- Assess the risk of AI vendors and AI-enabled services, including model and data handling, training-data use and boundaries, prompt and output controls, data residency, and alignment with AI governance frameworks (e.g., NIST AI RMF, ISO 42001, EU AI Act)
- Oversee fourth parties and sub-processors: map critical downstream dependencies, track sub-processor changes, and assess concentration, business continuity, and supply-chain risk for critical vendors
- Run continuous monitoring of the vendor population using security ratings, breach and threat intelligence, certification expirations, and tier-based reassessment cadences, and lead third-party response when a vendor has a security incident
- Maintain the third-party risk register and track issues, findings, and remediation plans with vendors and internal owners through to closure, with defined SLAs and escalation paths
- Operate and extend GRC platforms (e.g., Vanta) as the system of record for vendor inventory, assessments, and evidence; use automation, scripting, low-code, and AI-assisted workflows to streamline intake, tiering, questionnaire review, evidence collection, and reassessment
- Develop and maintain TPRM policies, standards, procedures, and runbooks that align with SpaceXSI's control environment and frameworks such as SOC 2, ISO 27001, ISO 42001, and NIST CSF / SP 800-53, and support internal and external audits with third-party evidence
- Create and present concise reporting on vendor risk posture, program health, open findings, high-risk vendors, and emerging third-party risk themes to GRC, Security, and business leadership, and guide business owners on TPRM requirements and expectations
BASIC QUALIFICATIONS:- Bachelor's degree in computer science, information security, cybersecurity, or in an engineering/STEM discipline
- 5+ years of experience in third-party risk management, vendor security, cybersecurity GRC, IT audit, or a role in security, with hands-on responsibility for performing assessments rather than only administering a program
PREFERRED SKILLS AND EXPERIENCE:- 7+ years of third-party risk, vendor security, cybersecurity GRC, or technology audit experience (mid-to-senior scope)
- Experience building, scaling, or maturing a TPRM program at a technology, cloud, AI, or fintech company, ideally in a high-growth environment
- Demonstrated experience running vendor security assessments end to end across a diverse vendor population, including issuing questionnaires, evaluating evidence, assigning risk ratings, and driving remediation
- Hands-on experience reviewing SOC 2 reports, ISO 27001 certifications, and penetration test summaries, including identifying scope limitations, carve-outs, exceptions, and CUECs
- Solid understanding of common security and compliance frameworks (e.g., SOC 2, ISO 27001, NIST CSF, NIST SP 800-53) and how vendor controls map to them
- Working technical fluency on-prem and in cloud environments (AWS, GCP, or Azure), SaaS architectures, identity and access management, encryption, data flows, incident response, and business continuity and disaster recovery - enough to evaluate vendor responses and speak credibly with engineers and vendors
- Experience partnering with Legal and Procurement on vendor contract security and privacy terms (e.g., security addendums, DPAs)
- Strong written and verbal communication skills, with the ability to explain risk and tradeoffs to procurement, legal, engineering, and business audiences
- Familiarity with AI governance topics relevant to vendor diligence (e.g., model data handling, training-data boundaries, ISO 42001 / NIST AI RMF concepts, EU AI Act awareness)
- Experience with GRC and TPRM platforms such as Vanta, Drata, OneTrust, ServiceNow VRM, Archer, or similar, and with security ratings tools (e.g., SecurityScorecard, BitSight, UpGuard)
- Experience managing supply chain and vendor risk for data center hardware, including hardware compliance
- Experience automating TPRM workflows with scripting, low-code, or AI-assisted tooling, such as intake forms, tiering logic, questionnaire analysis, evidence collection, and reassessment triggers
- Working knowledge of data privacy frameworks (e.g., GDPR, CCPA, HIPAA) as they apply to vendors and sub-processors
- Experience with supply-chain and fourth-party risk analysis, including concentration risk and business continuity for critical vendors
- Experience supporting internal audits, external audits, or regulatory examinations with third-party risk evidence
- Comfort operating with ambiguity - setting precedent and documenting new standards where none exist, while keeping assessments consistent and defensible
- Certifications such as CTPRP, CISSP, CISA, CISM, CRISC, CIPP/US, CIPT, ISO 27001 Lead Auditor, or similar preferred
- Experience supporting public sector, financial services, or other highly regulated vendor oversight requirements (e.g., FedRAMP, NIST 800-171, PCI DSS, DORA) is a plus
ADDITIONAL REQUIREMENTS:- This role may require occasional travel
- Ability to work effectively in a fast-paced, high-growth environment with evolving priorities
- Must be able to handle sensitive vendor and security information with discretion
COMPENSATION AND BENEFITS:$132,000 - $228,000 USD
Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks.
