# Sr. Security Analyst, Third Party Risk Management **Company**: SpaceXSI **Location**: Austin, TX **Experience**: senior **Job type**: full-time **Salary**: $132,000 - $228,000 USD **Category**: Security **Industry**: Technology **Apply**: https://job-boards.greenhouse.io/xai/jobs/5282197007?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/job/sr-security-analyst-third-party-risk-management-1883850e-a75/ ## Description We are seeking a mid-to-senior Governance, Risk, and Compliance (GRC) professional focused on third-party risk management (TPRM) to own and scale our vendor risk program as SpaceXSI grows. This role sits at the intersection of cybersecurity GRC, vendor management, and procurement: you will assess the full range of third parties the company depends on , software and SaaS providers, cloud and infrastructure partners, AI model and data providers, professional services firms, and other suppliers , from intake and due diligence through ongoing monitoring and offboarding. The ideal candidate brings a cybersecurity and GRC perspective , fluent in how cloud services, identity and access management, encryption, data flows, and AI/LLM systems actually work in production , and can translate assessment findings into clear, risk-based decisions on residual risk and compensating controls rather than simply documenting issues. **Responsibilities:** - Own the end-to-end third-party risk lifecycle , intake, inherent risk tiering, due diligence, risk decisioning, contracting support, ongoing monitoring, and offboarding , for vendors and partners across the company - Design and maintain the risk-tiering methodology and inherent risk questionnaire based on data sensitivity, system and network access, business criticality, and regulatory exposure - Conduct security, privacy, and business due diligence: issue and review security questionnaires, evaluate architecture diagrams and data flows, run follow-up sessions with vendor security teams - Critically review independent assurance reports and security documentation, including SOC 1/SOC 2 Type II reports, ISO 27001 and ISO 42001 certificates and Statements of Applicability - Translate findings into clear risk decisions: weigh residual risk and compensating controls, recommend approval, conditional approval, or rejection - Partner with Legal and Procurement to define and negotiate contract security terms - Assess the risk of AI vendors and AI-enabled services, including model and data handling, training-data use and boundaries - Oversee fourth parties and sub-processors: map critical downstream dependencies, track sub-processor changes - Run continuous monitoring of the vendor population using security ratings, breach and threat intelligence - Maintain the third-party risk register and track issues, findings, and remediation plans with vendors and internal owners through to closure - Operate and extend GRC platforms as the system of record for vendor inventory, assessments, and evidence - Develop and maintain TPRM policies, standards, procedures, and runbooks that align with SpaceXSI's control environment and frameworks - Create and present concise reporting on vendor risk posture, program health, open findings, high-risk vendors, and emerging third-party risk themes **Basic Qualifications:** - Bachelor's degree in computer science, information security, cybersecurity, or in an engineering/STEM discipline - 5+ years of experience in third-party risk management, vendor security, cybersecurity GRC, IT audit **Preferred Skills and Experience:** - 7+ years of third-party risk, vendor security, cybersecurity GRC, or technology audit experience - Experience building, scaling, or maturing a TPRM program at a technology, cloud, AI, or fintech company - Demonstrated experience running vendor security assessments end to end across a diverse vendor population - Hands-on experience reviewing SOC 2 reports, ISO 27001 certifications, and penetration test summaries - Solid understanding of common security and compliance frameworks - Working technical fluency on-prem and in cloud environments, SaaS architectures, identity and access management, encryption, data flows - Experience partnering with Legal and Procurement on vendor contract security and privacy terms - Strong written and verbal communication skills - Familiarity with AI governance topics relevant to vendor diligence - Experience with GRC and TPRM platforms such as Vanta, Drata, OneTrust - Experience managing supply chain and vendor risk for data center hardware - Experience automating TPRM workflows with scripting, low-code, or AI-assisted tooling - Working knowledge of data privacy frameworks - Experience with supply-chain and fourth-party risk analysis - Experience supporting internal audits, external audits, or regulatory examinations with third-party risk evidence **Compensation and Benefits:** $132,000 - $228,000 USD Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks. For more fresh new jobs, check out [yubhub.co](https://yubhub.co/). ## Skills ### Required - cloud services - identity and access management - encryption - data flows - AI/LLM systems - GRC - vendor management - procurement - cybersecurity - risk management ### Nice to have - AI governance - data privacy frameworks - supply-chain risk analysis - fourth-party risk analysis - GRC platforms - automation tooling - scripting - low-code tooling - AI-assisted tooling --- Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/xai/jobs/5282197007?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)