About the Role
We are seeking a Security Analyst to support the organization's Third-Party Risk Management (TPRM) program, with a primary focus on application and security architecture reviews of external vendors and SaaS providers.
This role sits at the intersection of security architecture, vendor assessment, and GRC reporting. The analyst will evaluate vendor-provided documentation, analyze cloud-based technology stacks, and produce structured security assessment outputs that feed directly into the GRC team's formal risk reporting process.
A key part of this role involves working with incomplete or unclear vendor documentation and performing independent research (including OSINT techniques) to accurately understand vendor architectures and security posture.
Key Responsibilities
- Perform detailed security architecture and application reviews of third-party vendors, SaaS platforms, and external services.
- Request and evaluate vendor documentation such as:
Architecture diagrams
Security practices and policies
Compliance reports (SOC 2, ISO 27001, etc.)
Penetration test summaries
- Data flow and integration diagrams
- Use a standardized internal assessment framework to evaluate expected controls and determine vendor risk levels.
- Translate technical findings into a structured document used by the GRC team for formal risk reporting.
- Conduct independent research and OSINT analysis when vendor documentation is incomplete or missing.
- Assess a wide variety of modern and niche cloud-based technology stacks.
- Communicate directly with vendors to clarify architecture, controls, and security posture.
- Collaborate primarily with GRC and occasionally with Procurement and Engineering during vendor evaluations.
- Manage multiple concurrent vendor assessments with minimal supervision.
Required Skills & Experience
- 3+ years experience in any of the following:
Security analysis
Security architecture review
Application security
Third-party/vendor risk management
Cloud security assessment
- Strong ability to interpret:
Architecture diagrams
Security documentation
- Data flows and system integrations
- Familiarity with cloud-based and SaaS technology stacks.
- Experience evaluating vendor security posture against defined security control requirements.
- Strong analytical, research, and documentation skills.
- Comfortable working with ambiguous or incomplete information.
- Self-motivated and able to work independently across multiple assessments.
Highly Preferred
- Experience in Third-Party Risk Management (TPRM) or Supply Chain Risk Management.
- Experience performing security reviews for SaaS or cloud vendors.
- Familiarity with OSINT techniques for technology and architecture research.
- Exposure to GRC processes and risk reporting.
Key Traits for Success
- Naturally curious and investigative mindset.
- Comfortable navigating unfamiliar technologies and niche stacks.
- Detail-oriented with strong written communication skills.
- Able to translate technical architecture into risk language for GRC reporting.
- Proactive, independent, and highly organized.
