Sr. Security Analyst, Third Party Risk Management

SR. SECURITY ANALYST, THIRD PARTY RISK MANAGEMENT

We are seeking a mid-to-senior Governance, Risk, and Compliance (GRC) professional focused on third-party risk management (TPRM) to own and scale our vendor risk program as SpaceXSI grows. This role sits at the intersection of cybersecurity GRC, vendor management, and procurement: you will assess the full range of third parties the company depends on — software and SaaS providers, cloud and infrastructure partners, AI model and data providers, professional services firms, and other suppliers — from intake and due diligence through ongoing monitoring and offboarding. The ideal candidate brings a cybersecurity and GRC perspective — fluent in how cloud services, identity and access management, encryption, data flows, and AI/LLM systems actually work in production — and can translate assessment findings into clear, risk-based decisions on residual risk and compensating controls rather than simply documenting issues. You will collaborate across procurement, legal, security, privacy, engineering, and business owners to keep third-party risk clear, proportionate, and actionable across enterprise, commercial, and public-sector environments.

RESPONSIBILITIES:

• Own the end-to-end third-party risk lifecycle — intake, inherent risk tiering, due diligence, risk decisioning, contracting support, ongoing monitoring, and offboarding — for vendors and partners across the company
• Design and maintain the risk-tiering methodology and inherent risk questionnaire based on data sensitivity, system and network access, business criticality, and regulatory exposure, so that assessment depth matches actual risk and lower-risk vendors move quickly
• Conduct security, privacy, and business due diligence: issue and review security questionnaires (e.g., SIG, CAIQ, custom assessments), evaluate architecture diagrams and data flows, run follow-up sessions with vendor security teams, and coordinate business checks such as corporate registration, reputational review, and insurance coverage with cross-functional partners
• Critically review independent assurance reports and security documentation, including SOC 1/SOC 2 Type II reports, ISO 27001 and ISO 42001 certificates and Statements of Applicability, penetration test and vulnerability summaries, and bridge letters. Evaluate scope, carve-outs, exceptions, and complementary user entity controls (CUECs) that SpaceXSI must operate
• Translate findings into clear risk decisions: weigh residual risk and compensating controls, recommend approval, conditional approval, or rejection, and document risk exceptions and risk acceptances with clear rationale, owners, and expiration dates
• Partner with Legal and Procurement to define and negotiate contract security terms, including security and data protection exhibits, DPAs, breach notification, right-to-audit, sub-processor clauses, and data retention and deletion requirements, and ensure SpaceXSI's compliance obligations flow down to vendors and sub-processors
• Assess the risk of AI vendors and AI-enabled services, including model and data handling, training-data use and boundaries, prompt and output controls, data residency, and alignment with AI governance frameworks (e.g., NIST AI RMF, ISO 42001, EU AI Act)
• Oversee fourth parties and sub-processors: map critical downstream dependencies, track sub-processor changes, and assess concentration, business continuity, and supply-chain risk for critical vendors
• Run continuous monitoring of the vendor population using security ratings, breach and threat intelligence, certification expirations, and tier-based reassessment cadences, and lead third-party response when a vendor has a security incident
• Maintain the third-party risk register and track issues, findings, and remediation plans with vendors and internal owners through to closure, with defined SLAs and escalation paths
• Operate and extend GRC platforms (e.g., Vanta) as the system of record for vendor inventory, assessments, and evidence; use automation, scripting, low-code, and AI-assisted workflows to streamline intake, tiering, questionnaire review, evidence collection, and reassessment
• Develop and maintain TPRM policies, standards, procedures, and runbooks that align with SpaceXSI's control environment and frameworks such as SOC 2, ISO 27001, ISO 42001, and NIST CSF / SP 800-53, and support internal and external audits with third-party evidence
• Create and present concise reporting on vendor risk posture, program health, open findings, high-risk vendors, and emerging third-party risk themes to GRC, Security, and business leadership, and guide business owners on TPRM requirements and expectations

BASIC QUALIFICATIONS:

• Bachelor's degree in computer science, information security, cybersecurity, or in an engineering/STEM discipline
• 5+ years of experience in third-party risk management, vendor security, cybersecurity GRC, IT audit, or a role in security, with hands-on responsibility for performing assessments rather than only administering a program

PREFERRED SKILLS AND EXPERIENCE:

• 7+ years of third-party risk, vendor security, cybersecurity GRC, or technology audit experience (mid-to-senior scope)
• Experience building, scaling, or maturing a TPRM program at a technology, cloud, AI, or fintech company, ideally in a high-growth environment
• Demonstrated experience running vendor security assessments end to end across a diverse vendor population, including issuing questionnaires, evaluating evidence, assigning risk ratings, and driving remediation
• Hands-on experience reviewing SOC 2 reports, ISO 27001 certifications, and penetration test summaries, including identifying scope limitations, carve-outs, exceptions, and CUECs
• Solid understanding of common security and compliance frameworks (e.g., SOC 2, ISO 27001, NIST CSF, NIST SP 800-53) and how vendor controls map to them
• Working technical fluency on-prem and in cloud environments (AWS, GCP, or Azure), SaaS architectures, identity and access management, encryption, data flows, incident response, and business continuity and disaster recovery — enough to evaluate vendor responses and speak credibly with engineers and vendors
• Experience partnering with Legal and Procurement on vendor contract security and privacy terms (e.g., security addendums, DPAs)
• Strong written and verbal communication skills, with the ability to explain risk and tradeoffs to procurement, legal, engineering, and business audiences
• Familiarity with AI governance topics relevant to vendor diligence (e.g., model data handling, training-data boundaries, ISO 42001 / NIST AI RMF concepts, EU AI Act awareness)
• Experience with GRC and TPRM platforms such as Vanta, Drata, OneTrust, ServiceNow VRM, Archer, or similar, and with security ratings tools (e.g., SecurityScorecard, BitSight, UpGuard)
• Experience managing supply chain and vendor risk for data center hardware, including hardware compliance
• Experience automating TPRM workflows with scripting, low-code, or AI-assisted tooling, such as intake forms, tiering logic, questionnaire analysis, evidence collection, and reassessment triggers
• Working knowledge of data privacy frameworks (e.g., GDPR, CCPA, HIPAA) as they apply to vendors and sub-processors
• Experience with supply-chain and fourth-party risk analysis, including concentration risk and business continuity for critical vendors
• Experience supporting internal audits, external audits, or regulatory examinations with third-party risk evidence
• Comfort operating with ambiguity — setting precedent and documenting new standards where none exist, while keeping assessments consistent and defensible
• Certifications such as CTPRP, CISSP, CISA, CISM, CRISC, CIPP/US, CIPT, ISO 27001 Lead Auditor, or similar preferred
• Experience supporting public sector, financial services, or other highly regulated vendor oversight requirements (e.g., FedRAMP, NIST 800-171, PCI DSS, DORA) is a plus

ADDITIONAL REQUIREMENTS:

• This role may require occasional travel
• Ability to work effectively in a fast-paced, high-growth environment with evolving priorities
• Must be able to handle sensitive vendor and security information with discretion

COMPENSATION AND BENEFITS:

$132,000 - $228,000 USD

Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks.

ITAR REQUIREMENTS:

• To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here.