Sr. Security Analyst, Third Party Risk Management

We are seeking a mid-to-senior Governance, Risk, and Compliance (GRC) professional focused on third-party risk management (TPRM) to own and scale our vendor risk program as SpaceXSI grows.

This role sits at the intersection of cybersecurity GRC, vendor management, and procurement: you will assess the full range of third parties the company depends on , software and SaaS providers, cloud and infrastructure partners, AI model and data providers, professional services firms, and other suppliers , from intake and due diligence through ongoing monitoring and offboarding.

The ideal candidate brings a cybersecurity and GRC perspective , fluent in how cloud services, identity and access management, encryption, data flows, and AI/LLM systems actually work in production , and can translate assessment findings into clear, risk-based decisions on residual risk and compensating controls rather than simply documenting issues.

Responsibilities:

• Own the end-to-end third-party risk lifecycle , intake, inherent risk tiering, due diligence, risk decisioning, contracting support, ongoing monitoring, and offboarding , for vendors and partners across the company
• Design and maintain the risk-tiering methodology and inherent risk questionnaire based on data sensitivity, system and network access, business criticality, and regulatory exposure
• Conduct security, privacy, and business due diligence: issue and review security questionnaires, evaluate architecture diagrams and data flows, run follow-up sessions with vendor security teams
• Critically review independent assurance reports and security documentation, including SOC 1/SOC 2 Type II reports, ISO 27001 and ISO 42001 certificates and Statements of Applicability
• Translate findings into clear risk decisions: weigh residual risk and compensating controls, recommend approval, conditional approval, or rejection
• Partner with Legal and Procurement to define and negotiate contract security terms
• Assess the risk of AI vendors and AI-enabled services, including model and data handling, training-data use and boundaries
• Oversee fourth parties and sub-processors: map critical downstream dependencies, track sub-processor changes
• Run continuous monitoring of the vendor population using security ratings, breach and threat intelligence
• Maintain the third-party risk register and track issues, findings, and remediation plans with vendors and internal owners through to closure
• Operate and extend GRC platforms as the system of record for vendor inventory, assessments, and evidence
• Develop and maintain TPRM policies, standards, procedures, and runbooks that align with SpaceXSI's control environment and frameworks
• Create and present concise reporting on vendor risk posture, program health, open findings, high-risk vendors, and emerging third-party risk themes

Basic Qualifications:

• Bachelor's degree in computer science, information security, cybersecurity, or in an engineering/STEM discipline
• 5+ years of experience in third-party risk management, vendor security, cybersecurity GRC, IT audit

Preferred Skills and Experience:

• 7+ years of third-party risk, vendor security, cybersecurity GRC, or technology audit experience
• Experience building, scaling, or maturing a TPRM program at a technology, cloud, AI, or fintech company
• Demonstrated experience running vendor security assessments end to end across a diverse vendor population
• Hands-on experience reviewing SOC 2 reports, ISO 27001 certifications, and penetration test summaries
• Solid understanding of common security and compliance frameworks
• Working technical fluency on-prem and in cloud environments, SaaS architectures, identity and access management, encryption, data flows
• Experience partnering with Legal and Procurement on vendor contract security and privacy terms
• Strong written and verbal communication skills
• Familiarity with AI governance topics relevant to vendor diligence
• Experience with GRC and TPRM platforms such as Vanta, Drata, OneTrust
• Experience managing supply chain and vendor risk for data center hardware
• Experience automating TPRM workflows with scripting, low-code, or AI-assisted tooling
• Working knowledge of data privacy frameworks
• Experience with supply-chain and fourth-party risk analysis
• Experience supporting internal audits, external audits, or regulatory examinations with third-party risk evidence

Compensation and Benefits:

$132,000 - $228,000 USD

Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks.