Third-Party Security Risk Analyst

Job not on LinkedIn

🔥 4 minutes ago

🇺🇸 United States – Remote

💵 $58k - $110k / year

⏰ Full Time

🟡 Mid-level

🟠 Senior

🎲 Risk

👻 Ghost score 0%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Devoted Health

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2017

🏥 Healthcare

⚕️ Healthcare Insurance

🧘 Wellness

Healthcare • Healthcare Insurance • Wellness

Devoted Health is a healthcare company that offers Medicare Advantage plans designed to provide comprehensive health coverage with added benefits like dental, eyewear, gym memberships, and prescription drugs at competitive rates. The company emphasizes member support and service, ensuring that clients can easily navigate their benefits and access needed healthcare services. Devoted Health is committed to helping customers save money and enhance their health and wellness through a complete package of benefits and support.

📋 Description

• Support onboarding and reassessment of third-party vendors under the Security purview • Gather information, document risks, facilitate stakeholder discussions, evaluate inherent and residual risk, and track follow-up actions and remediation activities • Perform initial impact assessments and assign vendor risk tiers using data classification, system access, operational criticality, and regulatory exposure • Carry out standardized third-party risk assessments, including reviewing security questionnaires, SOC reports, and supporting evidence • Track assessment status and follow up with risk domain owners • Document risk findings, ratings, and inherent and residual risk scores • Monitor open findings and remediation commitments and escalate overdue items • Help verify vendor contracts include required Infosec addendum clauses • Maintain procedures, templates, and guidelines for the TPRM program • Support internal and external audits by preparing evidence and responding to requests • Support AI-enabled automation improvements in the vendor risk program • Evaluate AI usage in vendors’ products and services, including data protection, model and platform risk, and contractual and regulatory expectations • Execute the full TPRM lifecycle from initial vendor assessments through ongoing monitoring and offboarding • Collaborate with Legal, Procurement, Compliance, ERM, Finance, Risk, and business stakeholders

🎯 Requirements

• Practical experience in third-party risk management, vendor management, procurement, information security, compliance, or audit (relevant internships count) • Basic understanding of third-party risk concepts, governance policies, and common security frameworks (e.g., HITRUST, NIST CSF, ISO 27001, ISO 42001, SOC 2) • Exposure to vendor lifecycle procedures, including onboarding, ongoing monitoring, and offboarding • Exposure to contract clause review for security, privacy, and business resilience controls • Familiarity with findings or vulnerability remediation tracking • Awareness of software and hardware supply chain risk • Strong analytical skills with the ability to interpret data and spot gaps or inconsistencies in vendor responses • Excellent organizational skills and attention to detail, with the ability to manage multiple assessments at once • Strong written and verbal communication skills • Comfort working cross-functionally with Legal, Finance, Risk, Procurement, and business stakeholders • Bachelor's degree in risk management, information security, privacy, compliance, business, or a related discipline (desired) • 3-5 years of experience in a third-party risk management role, including vendor management (desired) • Familiarity with cloud security controls and shared responsibility models across AWS, Azure, and GCP • Awareness of AI-related risks and controls, including data usage and retention, model transparency, responsible AI practices, NIST AI Risk Management Framework, or ISO/IEC 42001 • Knowledge of healthcare regulations such as HIPAA and HITRUST • Relevant certifications or progress toward them, such as CISA or CIA (desired)

🏖️ Benefits

• Employer sponsored health, dental and vision plan with low or no premium • Generous paid time off • $100 monthly mobile or internet stipend • Stock options for all employees • Bonus eligibility for all roles excluding Director and above • Parental leave program • 401K program • Total rewards package for full time employees

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume