Sr. Security Analyst, Third Party Risk Management

The role

You will own and grow the third-party risk program for SpaceXSI, assessing software, cloud, AI model and data, services and other vendors from intake through monitoring and offboarding. You will translate findings into risk decisions and work with procurement, legal, security and business owners.

What you will do

• Own the full third-party risk lifecycle for vendors and partners
• Design and maintain the risk-tiering method and inherent risk questionnaire
• Run security, privacy and business due diligence on vendors
• Review SOC 1/SOC 2 Type II, ISO 27001 and ISO 42001 reports, and pen test summaries
• Make risk decisions and document exceptions and risk acceptances
• Negotiate security and data protection contract terms with Legal and Procurement
• Assess AI vendors and AI-enabled services
• Oversee fourth parties and sub-processors
• Monitor the vendor population and lead response to vendor security incidents
• Maintain the third-party risk register and write policies and reports for leadership

Required qualifications

• Bachelor's degree in computer science, information security, cybersecurity, or an engineering/STEM discipline
• 5+ years in third-party risk management, vendor security, cybersecurity GRC, IT audit, or security, with hands-on assessment work
• Must be a U.S. citizen or national, U.S. lawful permanent resident, refugee under 8 U.S.C. § 1157, or asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. D
• Ability to handle sensitive vendor and security information with discretion
• Ability to work in a fast-paced, high-growth environment with evolving priorities

Nice to have

• 7+ years of third-party risk, vendor security, cybersecurity GRC, or technology audit experience
• Experience building or maturing a TPRM program at a technology, cloud, AI or fintech company
• Hands-on experience reviewing SOC 2 reports, ISO 27001 certifications and pen test summaries
• Working knowledge of SOC 2, ISO 27001, NIST CSF and NIST SP 800-53
• Technical fluency in AWS, GCP or Azure, SaaS, IAM, encryption and data flows
• Experience with GRC or TPRM platforms such as Vanta, Drata, OneTrust or ServiceNow VRM
• Experience with security ratings tools such as SecurityScorecard, BitSight or UpGuard
• Experience automating TPRM workflows with scripting, low-code or AI-assisted tools
• Certifications such as CTPRP, CISSP, CISA, CISM, CRISC, CIPP/US or ISO 27001 Lead Auditor
• Experience with FedRAMP, NIST 800-171, PCI DSS or DORA

Benefits

• Equity
• Comprehensive medical, vision and dental coverage
• 401(k) retirement plan
• Short and long-term disability insurance
• Life insurance
• Various other discounts and perks

Before you apply

• Export rules: applicant must meet the ITAR citizenship or status requirements above

About the company

SpaceXSI is building Super Intelligence to help humanity understand the universe, including Colossus supercomputers and Grok models and applications. The company is an equal opportunity employer.