Job Description
A bit about this role
Are you looking to build your career in cybersecurity while making a real difference for the members who depend on us? Our Cybersecurity Governance, Risk Management, and Compliance (GRC) team is looking for a Third-Party Security Risk Analyst to help run the day-to-day work of our Third-Party Risk Management (TPRM) program. You'll work alongside senior team members to assess our vendors, document risk, and keep our partnerships secure. It's hands-on work that directly shapes how safely we operate.
Your Responsibilities and Impact will include:
Support the onboarding and reassessment of third-party vendors under the Security purview. You'll gather information, document risks, facilitate stakeholder discussions, evaluate inherent and residual risk, and track follow-up actions and remediation activities.
- Impact Assessments & Tiering: Perform initial impact assessments on new and existing vendors and assign risk tiers using established criteria, such as data classification, system access, criticality to operations, and regulatory exposure. The tier sets the level and cadence of due diligence each vendor requires.
- Risk Assessments: Carry out standardized third-party risk assessments under the direction of senior team members, including reviewing security questionnaires, SOC reports, and supporting evidence.
- Assessment Tracking: Track assessment status and follow up with risk domain owners so submissions arrive on time.
- Risk Documentation: Document risk findings and ratings, including inherent and residual risk scores, clearly and consistently.
- Remediation Follow-Up: Monitor open findings and remediation commitments, and escalate overdue items.
- Contract Support: Help verify that vendor contracts include the required Infosec addendum clauses.
- Program Documentation: Help maintain procedures, templates, and guidelines so the program stays organized and repeatable.
- Audit Support: Support internal and external audits of the vendor risk program by preparing evidence and responding to requests.
- Innovation: Support efforts to improve AI-enabled automation into the vendor risk program.
- Emerging AI Risk: Help evaluate AI usage in vendors’ products and services, including how they protect data, manage model and platform risk, and meet contractual and regulatory expectations.
At the Heart of It
You'll execute the full TPRM lifecycle, from initial vendor assessments through ongoing monitoring and offboarding. Along the way you'll help third-party services join our ecosystem without compromising our security or our values.
Why Step Into This Role
This role is a strong foundation for a career in cybersecurity GRC. You'll get direct mentorship from experienced TPRM and security professionals and exposure to Legal, Procurement, Compliance, and ERM. You'll also get the chance to grow your skills while contributing to Devoted's resilience against cybersecurity threats.
Required skills and experience:
- Practical experience in third-party risk management, vendor management, procurement, information security, compliance, or audit (relevant internships count)
- Basic understanding of third-party risk concepts, governance policies, and common security frameworks (e.g., HITRUST, NIST CSF, ISO 27001, ISO 42001, SOC 2)
- Exposure to vendor lifecycle procedures, including onboarding, ongoing monitoring, and offboarding
- Exposure to contract clause review for security, privacy, and business resilience controls
- Familiarity with findings or vulnerability remediation tracking
- Awareness of software and hardware supply chain risk
- Strong analytical skills with the ability to interpret data and spot gaps or inconsistencies in vendor responses
- Excellent organizational skills and attention to detail, with the ability to manage multiple assessments at once
- Strong written and verbal communication skills
- Comfort working cross-functionally with Legal, Finance, Risk, Procurement, and business stakeholders
Desired skills and experience:
- Bachelor's degree in risk management, information security, privacy, compliance, business, or a related discipline
- 3-5 years of experience in a third-party risk management role, including vendor management
- Familiarity with cloud security controls and shared responsibility models across major providers (e.g., AWS, Azure, GCP), including how to evaluate a vendor's cloud environment during an assessment
- Awareness of AI-related risks and controls, such as data usage and retention, model transparency, and responsible AI practices, and of emerging frameworks like the NIST AI Risk Management Framework or ISO/IEC 42001
- Knowledge of healthcare regulations such as HIPAA and HITRUST
- Relevant certifications, or progress toward them (e.g., CISA, CIA)
Salary Range: $58,000 - $110,000/year
The pay range listed for this position is the range the organization reasonably and in good faith expects to pay for this position at the time of the posting. Once the interview process begins, your talent partner will provide additional information on the compensation for the role, along with additional information on our total rewards package. The actual base salary offered will depend on a variety of factors, including the qualifications of the individual applicant for the position, years of relevant experience, specific and unique skills, level of education attained, certifications or other professional licenses held, and the location in which the applicant lives and/or from which they will be performing the job.
Our Total Rewards package includes:
Employer sponsored health, dental and vision plan with low or no premium
Generous paid time off
$100 monthly mobile or internet stipend
Stock options for all employees
Bonus eligibility for all roles excluding Director and above; Commission eligibility for Sales roles
Parental leave program
401K program
And more....
*Our total rewards package is for full time employees only. Intern and Contract positions are not eligible.
