Security Analyst, Third-Party Ecosystem Risk Management

The role

You will run end-to-end security risk assessments for Plaid's third parties, including vendors, customers, and partners. You will manage the third-party risk lifecycle and help mature the program through improved processes and AI-assisted workflows.

What you will do

• Run Vendor Security Risk Assessments by triaging requests and rating risk.
• Vet Customer and Partner Security Posture using established standards.
• Maintain the third-party risk lifecycle including tiering and reassessments.
• Mature the program by improving questionnaires, tiering criteria, and runbooks.
• Report on ecosystem risk and program health to stakeholders.
• Scale workflows using AI and tooling for assessment review and reporting.

Required qualifications

• 4+ years of experience in vendor risk management
• Experience running security risk assessments of third parties
• Experience reviewing questionnaires, SOC 2 and ISO reports, and security documentation
• Familiarity with the third-party risk lifecycle
• Working knowledge of SOC 2, ISO 27001, NIST CSF, and common control domains
• Ability to read a control environment and identify gaps or compensating controls
• Experience maturing a third-party or vendor risk program
• Track record running assessments at volume
• Strong analytical and documentation skills
• Clear written and verbal communication
• Ability to work across Security, Legal, Procurement, and GTM
• Demonstrated ability to apply AI tooling to assessment review and reporting

Nice to have

• A third-party-risk or audit credential (CTPRP, CISA, or CISSP)
• Hands-on ownership of a TPRM platform (e.g. OneTrust, ProcessUnity, Whistic, SecurityScorecard)

Benefits

• Medical
• Dental
• Vision
• 401(k)

About the company

Plaid builds tools and experiences that thousands of developers use to create products. The company's network covers 12,000 financial institutions across the US, Canada, UK and Europe.