We are seeking a Security Analyst to support the organization’s Third-Party Risk Management (TPRM) program, with a primary focus on application and security architecture reviews of external vendors and SaaS providers.
This role sits at the intersection of security architecture, vendor assessment, and GRC reporting. The analyst will evaluate vendor-provided documentation, analyze cloud-based technology stacks, and produce structured security assessment outputs that feed directly into the GRC team’s formal risk reporting process.
A key part of this role involves working with incomplete or unclear vendor documentation and performing independent research (including OSINT techniques) to accurately understand vendor architectures and security posture.
- Health Insurance/HMO
- Enjoy unlimited MadMax Coffee
- Diverse learning & growth opportunities
- Accessible Cloud HR platform (Sprout)
- Above standard leaves
Key Responsibilities
- Perform detailed security architecture and application reviews of third-party vendors, SaaS platforms, and external services.
- Request and evaluate vendor documentation such as:
Architecture diagrams
- Security practices and policies
- Compliance reports (SOC 2, ISO 27001, etc.)
- Penetration test summaries
- Data flow and integration diagrams
- Use a standardized internal assessment framework to evaluate expected controls and determine vendor risk levels.
- Translate technical findings into a structured document used by the GRC team for formal risk reporting.
- Conduct independent research and OSINT analysis when vendor documentation is incomplete or missing.
- Assess a wide variety of modern and niche cloud-based technology stacks.
- Communicate directly with vendors to clarify architecture, controls, and security posture.
- Collaborate primarily with GRC and occasionally with Procurement and Engineering during vendor evaluations.
- Manage multiple concurrent vendor assessments with minimal supervision.
Required Skills & Experience
- 3+ years’ experience in any of the following:
- Security analysis
- Security architecture review
- Application security
- Third-party/vendor risk management
- Cloud security assessment
Strong ability to interpret:
- Architecture diagrams
- Security documentation
- Data flows and system integrations
- Familiarity with cloud-based and SaaS technology stacks.
- Experience evaluating vendor security posture against defined security control requirements.
- Strong analytical, research, and documentation skills.
- Comfortable working with ambiguous or incomplete information.
- Self-motivated and able to work independently across multiple assessments.
Highly Preferred
- Experience in Third-Party Risk Management (TPRM) or Supply Chain Risk Management.
- Experience performing security reviews for SaaS or cloud vendors.
- Familiarity with OSINT techniques for technology and architecture research.
- Exposure to GRC processes and risk reporting.
Key Traits for Success
- Naturally curious and investigative mindset.
- Comfortable navigating unfamiliar technologies and niche stacks.
- Detail-oriented with strong written communication skills.
- Able to translate technical architecture into risk language for GRC reporting.
- Proactive, independent, and highly organized.