# Security Analyst, Third-Party Ecosystem Risk Management

**Company:** [Plaid](https://hotfix.jobs/companies/plaid)
**Location:** New York, NY, Seattle, WA, Raleigh, NC, San Francisco, CA
**Role:** Security Engineering
**Salary:** $119k – $176k/yr
**Experience:** 4+ years
**Skills:** vendor risk management, third-party risk management, SOC 2, ISO 27001, nist csf, Access Control, encryption, Incident Response, business continuity, Risk Assessment, onetrust, processunity, whistic, securityscorecard, AI Tools
**Posted:** 2026-08-12

> Conducts end-to-end security risk assessments for vendors, customers, and partners while maintaining risk tiering, remediation, reassessments, and reporting. The role also matures third-party risk processes and uses AI-assisted workflows to scale assessment operations.

## Job Description

## Responsibilities

- Run end-to-end vendor security risk assessments, including intake, questionnaire review, risk rating, findings, exceptions, and documentation.
- Assess the security posture of customers and partners onboarding to the platform.
- Maintain third-party risk tiering, reassessment cadence, remediation tracking, and the risk register.
- Improve questionnaires, tiering criteria, intake processes, runbooks, workflows, automation, and tooling.
- Track assessment cycle times, backlog, open exceptions, and reassessment coverage; report ecosystem risk to Security and cross-functional stakeholders.
- Build and scale AI-assisted workflows for assessment review, questionnaire analysis, and reporting.

## Requirements

- **4+ years of experience in vendor risk management.**
- Experience conducting third-party security risk assessments, including reviewing questionnaires, SOC 2 and ISO reports, and security documentation.
- Familiarity with the third-party risk lifecycle: intake, tiering, exceptions, risk acceptance, remediation tracking, and periodic reassessment.
- Working knowledge of **SOC 2, ISO 27001, NIST CSF**, and common control domains such as access control, encryption, incident response, and business continuity/disaster recovery.
- Ability to evaluate control environments, identify genuine gaps, and assess compensating controls.
- Experience maturing third-party or vendor risk programs through improved tiering criteria, questionnaires, workflows, and automation.
- Track record of running assessments at volume while maintaining rigor.
- Strong analytical, documentation, written communication, and verbal communication skills.
- Ability to explain security risks clearly to Procurement, Legal, customers, and other stakeholders.
- Comfortable working across Security, Legal, Procurement, and go-to-market teams.
- Demonstrated ability to apply AI tooling to assessment review, questionnaire analysis, and reporting to increase throughput.

## Nice-to-haves

- Third-party risk or audit credential such as **CTPRP, CISA, or CISSP**.
- Hands-on ownership of a TPRM platform such as **OneTrust, ProcessUnity, Whistic, or SecurityScorecard**.

## Compensation and Benefits

- Annual base salary range: **$118,680–$175,800**.
- Additional compensation may include equity and/or commission, depending on the position offered.
- Comprehensive benefits include medical, dental, vision, and 401(k).

## Similar roles

- [Security engineer, application security](https://hotfix.jobs/jobs/9628b13e-773c-473a-9e94-16d7d5cf2900) - Writer - New York, NY - $119k – $210k/yr
- [System Safety Engineer, Autonomy Trucking](https://hotfix.jobs/jobs/c0bddf4e-fb45-4eb3-858f-068e881e5c48) - Applied Intuition - Sunnyvale, CA - $118k – $250k/yr
- [Identity & Endpoint Security Engineer](https://hotfix.jobs/jobs/5d8a3922-c87b-41f2-96c1-e648bce35e6a) - Northwood Space - Los Angeles, CA - $120k – $190k/yr
- [Security & Compliance Operations Manager](https://hotfix.jobs/jobs/90ac6643-526f-4aeb-bb4f-d71bc1af1fcd) - Mintlify - San Francisco, CA - $120k – $180k/yr
- [Product Security Manager](https://hotfix.jobs/jobs/e6c7e91d-a178-4872-8fa5-f6af356137a5) - Northwood Space - Los Angeles, CA - $120k – $190k/yr

**Apply:** https://hotfix.jobs/jobs/04d279a2-cca0-4b85-9c84-c8fb7b794013
**Canonical:** https://hotfix.jobs/jobs/04d279a2-cca0-4b85-9c84-c8fb7b794013