Plaid
Security Analyst, Third-Party Ecosystem Risk Management
$119K–$176K
Remote United States +4 · Remote · Full-time · Posted Aug 12, 2026
- Location
- Remote United States
Seattle Office
Raleigh Office
San Francisco HQ
New York City Office - Experience
- 4+ years of experience in vendor risk management.
About the job
Manages security risk assessments for vendors, customers, and partners, maintains the third-party risk lifecycle, and improves AI-assisted review and reporting workflows.
What you'll do
- Assess third parties’ security, document risk ratings and findings, and track exceptions and remediation.
- Maintain risk tiers, reassessment schedules, and the risk register; report program health to stakeholders.
- Improve assessment processes and use AI-assisted workflows for reviews, questionnaire analysis, and reporting.
What they ask for
- 4+ years of experience in vendor risk management.
- Experience assessing third-party security, reviewing questionnaires and SOC 2 and ISO reports, and assigning defensible risk ratings.
- Working knowledge of SOC 2, ISO 27001, NIST CSF, and common security control domains.
- Experience maturing a third-party or vendor risk program and applying AI tooling to assessment review, questionnaire analysis, and reporting.
Nice to have
- Third-party-risk or audit credential (CTPRP, CISA, or CISSP).
- Hands-on ownership of a TPRM platform, such as OneTrust, ProcessUnity, Whistic, or SecurityScorecard.
Pay
$118,680 – $175,800 (base salary)
Tools
SOC 2, ISO 27001, NIST CSF, OneTrust, ProcessUnity, Whistic, SecurityScorecard
AI focus
Build and scale AI-assisted workflows for assessment review, questionnaire analysis, and reporting to increase throughput.
Model-written summary · the original posting is authoritative