[Hiring] Third-Party Security Risk Analyst @Devoted Health

Role Description

Are you looking to build your career in cybersecurity while making a real difference for the members who depend on us? Our Cybersecurity Governance, Risk Management, and Compliance (GRC) team is looking for a Third-Party Security Risk Analyst to help run the day-to-day work of our Third-Party Risk Management (TPRM) program. You'll work alongside senior team members to assess our vendors, document risk, and keep our partnerships secure. It's hands-on work that directly shapes how safely we operate.

Your Responsibilities and Impact will include:

• Support the onboarding and reassessment of third-party vendors under the Security purview.
• Perform initial impact assessments on new and existing vendors and assign risk tiers using established criteria.
• Carry out standardized third-party risk assessments under the direction of senior team members.
• Track assessment status and follow up with risk domain owners.
• Document risk findings and ratings clearly and consistently.
• Monitor open findings and remediation commitments, and escalate overdue items.
• Help verify that vendor contracts include the required Infosec addendum clauses.
• Help maintain procedures, templates, and guidelines for the program.
• Support internal and external audits of the vendor risk program.
• Support efforts to improve AI-enabled automation into the vendor risk program.
• Help evaluate AI usage in vendors’ products and services.

At the Heart of It

You'll execute the full TPRM lifecycle, from initial vendor assessments through ongoing monitoring and offboarding. Along the way you'll help third-party services join our ecosystem without compromising our security or our values.

Why Step Into This Role

This role is a strong foundation for a career in cybersecurity GRC. You'll get direct mentorship from experienced TPRM and security professionals and exposure to Legal, Procurement, Compliance, and ERM.

Qualifications

• Practical experience in third-party risk management, vendor management, procurement, information security, compliance, or audit (relevant internships count).
• Basic understanding of third-party risk concepts, governance policies, and common security frameworks (e.g., HITRUST, NIST CSF, ISO 27001, ISO 42001, SOC 2).
• Exposure to vendor lifecycle procedures, including onboarding, ongoing monitoring, and offboarding.
• Exposure to contract clause review for security, privacy, and business resilience controls.
• Familiarity with findings or vulnerability remediation tracking.
• Awareness of software and hardware supply chain risk.
• Strong analytical skills with the ability to interpret data and spot gaps or inconsistencies in vendor responses.
• Excellent organizational skills and attention to detail, with the ability to manage multiple assessments at once.
• Strong written and verbal communication skills.
• Comfort working cross-functionally with Legal, Finance, Risk, Procurement, and business stakeholders.

Requirements

• Bachelor's degree in risk management, information security, privacy, compliance, business, or a related discipline.
• 3-5 years of experience in a third-party risk management role, including vendor management.
• Familiarity with cloud security controls and shared responsibility models across major providers (e.g., AWS, Azure, GCP).
• Awareness of AI-related risks and controls, such as data usage and retention, model transparency, and responsible AI practices.
• Knowledge of healthcare regulations such as HIPAA and HITRUST.
• Relevant certifications, or progress toward them (e.g., CISA, CIA).

Benefits

• Employer sponsored health, dental and vision plan with low or no premium.
• Generous paid time off.
• $100 monthly mobile or internet stipend.
• Stock options for all employees.
• Bonus eligibility for all roles excluding Director and above; Commission eligibility for Sales roles.
• Parental leave program.
• 401K program.
• And more....