# Security Analyst, Third-Party Ecosystem Risk Management **Company**: Plaid **Location**: New York City Office; Raleigh Office; San Francisco HQ; Seattle Office **Work arrangement**: hybrid **Experience**: senior **Job type**: Full time **Salary**: $118,680 - $175,800 **Category**: Security **Industry**: Technology **Apply**: https://jobs.ashbyhq.com/plaid/94752cfc-4a62-48c9-bcc0-e5f7f1905be6?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_7640b1af-2f2 ## Description We believe that the way people interact with their finances will drastically improve in the next few years. We’re dedicated to empowering this transformation by building the tools and experiences that thousands of developers use to create their own products. The Security Governance, Risk, and Compliance (GRC) team is part of Plaid’s security organization, focused on enabling the business by proactively managing information security risks and maintaining effective controls. Our mission is to reduce the likelihood and impact of security risks while operating a robust assurance program that builds trust with our customers, consumers, and data partners. As a Security Analyst, Third-Party Ecosystem Risk Management, you will run security risk assessments for Plaid’s third parties end-to-end,from intake and questionnaire through risk rating, findings, and tracked exceptions. You will assess the security posture of customers and partners onboarding to the platform with the same rigor we apply to vendors. You will keep the third-party risk lifecycle moving,risk tiering, reassessment cadence, remediation follow-through, and a clean, current risk register. **Responsibilities:** - Run Vendor Security Risk Assessments: Triage inbound vendor requests, run security reviews scaled to risk tier, rate the risk, and document findings and exceptions. - Vet Customer and Partner Security Posture: Review the security practices of customers and partners onboarding to the platform, applying the same standards you use for vendors. - Keep the Third-Party Risk Lifecycle Current: Maintain risk tiering, drive reassessments on cadence, chase remediation to closure, and keep the risk register accurate. - Mature the Program: Improve questionnaires, tiering criteria, intake, runbooks, and tooling as review volume grows. - Report on Ecosystem Risk: Track assessment cycle times, backlog, open exceptions, and reassessment coverage, and report program health to stakeholders. - Scale Through AI and Tooling: Build and scale AI-assisted workflows for assessment review, questionnaire analysis, and reporting. **Qualifications:** - 4+ years of experience in vendor risk management - Third-party and vendor security risk assessment: - Experience running security risk assessments of third parties. - Familiarity with the third-party risk lifecycle. - Security and compliance knowledge: - Working knowledge of SOC 2, ISO 27001, NIST CSF, and common control domains. - Ability to read a control environment and tell a real gap from an acceptable compensating control. - Program maturation and operational execution: - Experience maturing a third-party or vendor risk program. - Track record running assessments at volume without dropping rigor. - Communication and cross-functional effectiveness: - Clear written and verbal communication. - Comfortable working across Security, Legal, Procurement, and GTM. - AI fluency and tooling: - Demonstrated ability to apply AI tooling to assessment review, questionnaire analysis, and reporting. **Benefits:** - Comprehensive benefit plan, including medical, dental, vision, and 401(k) - Additional compensation in the form(s) of equity and/or commission ## Skills ### Required - SOC 2 - ISO 27001 - NIST CSF - vendor risk management - third-party risk assessment - security risk assessments - AI tooling ### Nice to have - CTPRP - CISA - CISSP - OneTrust - ProcessUnity - Whistic - SecurityScorecard --- Source: [Apply at jobs.ashbyhq.com](https://jobs.ashbyhq.com/plaid/94752cfc-4a62-48c9-bcc0-e5f7f1905be6?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)