Senior Vendor Risk Analyst

Fortress Information Security•Atlanta, GA

4h•$100,000 - $130,000•Hybrid

About The Position

The Senior Vendor Risk Analyst plays a pivotal role within the Supply Chain Risk Management (SCRM) team, leading third-party vendor risk assessments and shaping how a major energy organization manages supply chain cyber risk. Working directly with vendor relationship owners and cross-functional stakeholders across Legal, Supply Chain, Cybersecurity, and Technology, this role drives continuous improvement of the Third-Party Risk Management (TPRM) program and directly influences leadership-level business decisions. This position provides meaningful exposure to critical infrastructure protection under NERC CIP standards and offers a mission-driven opportunity to help secure systems that society depends on. This is an ideal role for an experienced risk professional seeking broad organizational influence, visibility, and impact. This role offers the opportunity to work closely with a major energy sector client in a highly integrated capacity. Based on performance, business needs, and client discretion, there may be future opportunities to transition into direct employment with the client organization.

Requirements

United States citizenship is required
7-10 years experience in security risk assessment, risk management, compliance or auditing
Strong knowledge of security control frameworks (e.g., NIST SP 800-53, ISO/IEC 27001:2013)
Ability to communicate clearly, confidently, and knowledgeably to internal and external stakeholders regarding the Program and assessment results
Demonstrated history of critical, independent, and creative thinking to enable continuous improvement or business success within the constraints of security imperatives
Ability to holistically assess the risk of a third party engagement, considering control gaps, the nature of the vendor relationship, and the way a vendor's products/services are leveraged required
Must have demonstrated history of critical, independent, and creative thinking with high attention to detail; this will enable continuous improvement and ensure auditable record trail for all assessment data
Prior experience overseeing one or more people in support of a technology solution or program
Demonstrated ability to work with and in cross-functional teams
One or more of the following certifications: TPCRA, C3PRMP, CTPRA CISSP, CASP, CISA, CISM, GIAC, PMP
Must be able to pass NERC CIP and Insider Threat Program background screening due to access to sensitive critical infrastructure and information regarding security capabilities
Occasional travel for industry collaboration/influence or professional development is expected
This is a hybrid role but three days per week in the office (Naperville, IL, Birmingham, AL or Atlanta, GA) is expected initially but will grow to four days per week in office during 2026. In-office expectations may change over time depending on organizational policy and supervisor’s requirements.

Nice To Haves

Experience working in a highly regulated industry
Prior experience advocating security policies, practices, controls, and standards to business and IT teams
Familiarity with basic requirements for architecting secure information systems
Familiarity with NERC’s Critical Infrastructure Protection (CIP) standards
Experience with non-IT risk such as operational, financial, Compliance and Regulatory, Strategic Risk, Legal Risk, and ESG risk (Environmental, Social, and Governance)

Responsibilities

In coordination with the customers vendor relationship owners, manage assessments of vendors’ security controls to identify shortfalls.
Communicate remediation options to the vendors
Collaborate with TPRM team members and business partners to complete assessments and determine risk mitigation strategies
Become an expert of the TPRM platform to identify and direct necessary customizations, enhancements, and record maintenance to a vendor-supported platform that enable relevant reporting and Program maturation
Develop an appreciation and understanding of various business units while employing your knowledge of security fundamentals to effectively communicate customer risk resulting from assessment findings
Proactively propose and implement changes to customer Program policy/practice to ensure a risk-informed approach to vendor/supply chain management
Collaborate across Supply Chain, Legal, Cybersecurity, and the Technology Organizations to create a shared picture of supplier risk
Support cross-functional teams to investigate, analyze, and make recommendations to leadership or process owners regarding technology solutions, security architecture, or security vulnerabilities
When appropriate, collaborate across Cyber org to identify compensating controls for significant vendor-specific risks to the company and its customers
Review vendor-proposed modifications to Master Service Agreements or Application Service Provider Agreements on behalf of customer to identify any unacceptable security risks associated with new language
Understand, relate, and transform regulatory requirements into information security policy, standards, procedures, and guidelines
Maintain current knowledge of information security concepts, technologies, and practices
Other duties as assigned

Benefits

Remote and Hybrid working environment
Competitive pay structure
Medical, dental, vision plans with employees covered up to 90% with highly progressive options for dependents and families
Company paid life, short- and long-term disability insurance
Employee Assistance Program
401(k) match
Flexible Paid Time Off
Parental Leave
professional growth opportunities through succession planning, up-skilling, and certifications
Tuition and certification reimbursement
Employee Referral Programs
Company Sponsored Events