Third-Party Security Risk Analyst

Are you looking to build your career in cybersecurity while making a real difference for the members who depend on us? Our Cybersecurity Governance, Risk Management, and Compliance (GRC) team is looking for a Third-Party Security Risk Analyst to help run the day-to-day work of our Third-Party Risk Management (TPRM) program. Youll work alongside senior team members to assess our vendors, document risk, and keep our partnerships secure. Its hands-on work that directly shapes how safely we operate.
Support the onboarding and reassessment of third-party vendors under the Security purview. Youll gather information, document risks, facilitate stakeholder discussions, evaluate inherent and residual risk, and track follow-up actions and remediation activities.
Perform initial impact assessments on new and existing vendors and assign risk tiers using established criteria, such as data classification, system access, criticality to operations, and regulatory exposure. Risk Assessments:
Carry out standardized third-party risk assessments under the direction of senior team members, including reviewing security questionnaires, SOC reports, and supporting evidence.
Track assessment status and follow up with risk domain owners so submissions arrive on time.
Risk Documentation:
Document risk findings and ratings, including inherent and residual risk scores, clearly and consistently.
Contract Support:
Help verify that vendor contracts include the required Infosec addendum clauses.
Help maintain procedures, templates, and guidelines so the program stays organized and repeatable.
Audit Support:
Support internal and external audits of the vendor risk program by preparing evidence and responding to requests.
Support efforts to improve AI-enabled automation into the vendor risk program.
Emerging AI Risk:
Help evaluate AI usage in vendors’ products and services, including how they protect data, manage model and platform risk, and meet contractual and regulatory expectations.
Youll execute the full TPRM lifecycle, from initial vendor assessments through ongoing monitoring and offboarding. Along the way youll help third-party services join our ecosystem without compromising our security or our values.
This role is a strong foundation for a career in cybersecurity GRC. Youll get direct mentorship from experienced TPRM and security professionals and exposure to Legal, Procurement, Compliance, and ERM. Practical experience in third-party risk management, vendor management, procurement, information security, compliance, or audit (relevant internships count)
Basic understanding of third-party risk concepts, governance policies, and common security frameworks (e.g., Exposure to vendor lifecycle procedures, including onboarding, ongoing monitoring, and offboarding
Exposure to contract clause review for security, privacy, and business resilience controls
Awareness of software and hardware supply chain risk
Strong analytical skills with the ability to interpret data and spot gaps or inconsistencies in vendor responses
Comfort working cross-functionally with Legal, Finance, Risk, Procurement, and business stakeholders
Bachelors degree in risk management, information security, privacy, compliance, business, or a related discipline
3-5 years of experience in a third-party risk management role, including vendor management
Familiarity with cloud security controls and shared responsibility models across major providers (e.g., AWS, Azure, GCP), including how to evaluate a vendors cloud environment during an assessment
Awareness of AI-related risks and controls, such as data usage and retention, model transparency, and responsible AI practices, and of emerging frameworks like the NIST AI Risk Management Framework or ISO/IEC 42001
The pay range listed for this position is the range the organization reasonably and in good faith expects to pay for this position at the time of the posting. Employer sponsored health, dental and vision plan with low or no premium
Stock options for all employees
Bonus eligibility for all roles excluding Director and above; Our total rewards package is for full time employees only. Intern and Contract positions are not eligible.
Our robust and seamlessly integrated care platform merges advanced data and AI access with world-class clinical and service experiences to create a member experience that is unlike the industry norm. To continue building upon our mission, we want to bring together those who share our values, embrace change and advancement, and are enthusiastic about where were going — all the while bringing their own unique qualities, experiences, and expertise, in hopes of further changing the healthcare experience.
We are committed to a safe and supportive work environment in which all employees have the opportunity to participate and contribute to the success of the business. We value diversity and collaboration. This commitment is embodied in Devoted’s Code of Conduct, our company values and the way we do business.
As an Equal Opportunity Employer, the Company does not discriminate on the basis of race, color, religion, sex, pregnancy status, marital status, national origin, disability, age, sexual orientation, veteran status, genetic information, gender identity, gender expression, or any other factor prohibited by law. Our management team is dedicated to this policy with respect to recruitment, hiring, placement, promotion, transfer, training, compensation, benefits, employee activities and general treatment during employment.