XTN-3E78732 | SECURITY ANALYST – PRODUCT & VENDOR

We are seeking a Security Analyst to support the organization’s Third-Party Risk Management (TPRM) program, with a primary focus on application and security architecture reviews of external vendors and SaaS providers.This role sits at the intersection of security architecture, vendor assessment, and GRC reporting. The analyst will evaluate vendor-provided documentation, analyze cloud-based technology stacks, and produce structured security assessment outputs that feed directly into the GRC team’s formal risk reporting process.A key part of this role involves working with incomplete or unclear vendor documentation and performing independent research (including OSINT techniques) to accurately understand vendor architectures and security posture.Health Insurance/HMO Enjoy unlimited MadMax CoffeeDiverse learning & growth opportunitiesAccessible Cloud HR platform (Sprout)Above standard leavesKey ResponsibilitiesPerform detailed security architecture and application reviews of third-party vendors, SaaS platforms, and external services.Request and evaluate vendor documentation such as:Architecture diagramsSecurity practices and policiesCompliance reports (SOC 2, ISO 27001, etc.)Penetration test summariesData flow and integration diagramsUse a standardized internal assessment framework to evaluate expected controls and determine vendor risk levels.Translate technical findings into a structured document used by the GRC team for formal risk reporting.Conduct independent research and OSINT analysis when vendor documentation is incomplete or missing.Assess a wide variety of modern and niche cloud-based technology stacks.Communicate directly with vendors to clarify architecture, controls, and security posture.Collaborate primarily with GRC and occasionally with Procurement and Engineering during vendor evaluations.Manage multiple concurrent vendor assessments with minimal supervision.Required Skills & Experience3+ years’ experience in any of the following:Security analysisSecurity architecture reviewApplication securityThird-party/vendor risk managementCloud security assessmentStrong ability to interpret:Architecture diagramsSecurity documentationData flows and system integrationsFamiliarity with cloud-based and SaaS technology stacks.Experience evaluating vendor security posture against defined security control requirements.Strong analytical, research, and documentation skills.Comfortable working with ambiguous or incomplete information.Self-motivated and able to work independently across multiple assessments.Highly PreferredExperience in Third-Party Risk Management (TPRM) or Supply Chain Risk Management.Experience performing security reviews for SaaS or cloud vendors.Familiarity with OSINT techniques for technology and architecture research.Exposure to GRC processes and risk reporting.Key Traits for SuccessNaturally curious and investigative mindset.Comfortable navigating unfamiliar technologies and niche stacks.Detail-oriented with strong written communication skills.Able to translate technical architecture into risk language for GRC reporting.Proactive, independent, and highly organized.Originally posted on Himalayas