Senior Third-Party Risk Management Analyst

Momentive

4d•Remote

About The Position

The Senior Third-Party Risk Management Analyst is a core member of Momentive Software's Cybersecurity, Risk & Compliance organization. The role maintains and matures the enterprise-wide third-party risk program, ensuring vendors, platforms, and service providers meet the company's cybersecurity, privacy, resiliency, and regulatory requirements. The Analyst partners with Client Success, Cybersecurity Engineering, TVM, Legal, Procurement, Product, and the CISO to evaluate vendor risk, oversee third-party controls, and support compliance obligations, including SOC 2 Type II and PCI DSS. The role also supports vulnerability notifications to clients who manage their own cybersecurity posture and provides clear, timely communications about vulnerabilities and remediation expectations. The position evaluates vendor risk and control maturity against cybersecurity frameworks, maintains audit-ready documentation, and supports audits and compliance activities. It also works with clients on vulnerability-related guidance, contributes to governance, risk, and compliance processes, supports vendor-related disaster recovery and business continuity planning, and promotes cybersecurity awareness across the organization. The Analyst serves as a contact for vendor-related risk issues and mentors team members while helping develop internal training materials and documentation.

Requirements

At least 5 years of experience in cybersecurity, risk management, audit, or compliance.
Deep understanding of regulatory requirements including PCI DSS, SOC 2, GDPR, GLBA, HIPAA, SOX, and HITRUST.
Experience evaluating legacy and modern cloud technologies, including AWS, GCP, and Azure.
Strong knowledge of APIs, application cybersecurity, encryption, endpoint security, and network cybersecurity concepts.
Familiarity with SIEM, IDS, log management, vulnerability management, and threat intelligence.
Ability to assess vendor controls, map them to frameworks, and explain risk to non-technical stakeholders.
Strong project management, multitasking, and organizational skills.
Excellent written and verbal communication skills.

Nice To Haves

Experience supporting SOC 2 Type II and PCI DSS audits.
Experience with eGRC/ITGRC platforms such as Jira Service Manager GRC, Archer, OneTrust, or LogicGate.
Certifications such as CISSP, CISM, CISA, CRISC, CTPRA, or CTPRP.

Responsibilities

Maintain the global inventory of third-party providers, applications, and services from onboarding through termination.
Lead vendor cybersecurity assessments in coordination with Cybersecurity Engineering, Legal, and business owners.
Assess vendor maturity using NIST CSF, CIS, CMMC, GDPR, PCI DSS, SOC 2, and other frameworks.
Oversee vendor SLAs, RPO/RTO commitments, breach notification requirements, and cybersecurity insurance documentation.
Document findings, recommendations, and remediation plans for vendor assessments.
Liaise with internal and external auditors on vendor-related controls and evidence collection.
Provide evidence, documentation, and control validation related to third-party dependencies for SOC 2 Type II and PCI DSS assessments.
Ensure vendor controls align with the company's ISMS, contractual obligations, and certification requirements.
Partner with the GRC team to maintain audit-ready policies, standards, procedures, and risk treatment plans.
Track vendor exceptions and compensating controls, supporting audit defensibility and continuous improvement.
Work with the TVM team on vulnerability notifications to clients who manage their own cybersecurity controls.
Ensure client communications are accurate, timely, and aligned with contractual commitments and industry best practices.
Advise clients on risk impact, remediation expectations, and recommended cybersecurity practices.
Maintain documentation and metrics for client notifications, follow-up actions, and closure.
Improve the ISMS by aligning vendor risk processes with company policies, standards, and procedures.
Provide input on control selection, risk treatment plans, and metrics for monitoring cybersecurity control effectiveness.
Monitor emerging threats, regulatory changes, and industry trends affecting third-party risk.
Support disaster recovery and business continuity planning related to vendor dependencies and resiliency requirements.
Coordinate with Legal, Cybersecurity, and leadership on vendor risk reduction strategies.
Promote cybersecurity culture through outreach, training, and awareness activities.
Provide professional and empathetic service to internal and external stakeholders.
Mentor team members and contribute to internal training materials and documentation.