Security Risk Manager

We are seeking a highly skilled and proactive Security Risk Manager to join our growing security team. You will be responsible for assessing, monitoring, and mitigating information security risks associated with third-party vendors and service providers. This role ensures vendor relationships comply with organizational security policies, industry regulations, and best practices to protect sensitive data and systems

Responsibilities

• Conduct comprehensive security risk assessments internally and of third-party vendors, including cloud providers, SaaS vendors, and IT service providers.
• Evaluate internal and third-party security controls, policies, and compliance with frameworks such as NIST, ISO 27001, SOC 2, GDPR, HIPAA, and PCI-DSS.
• Perform due diligence reviews, including security questionnaires, audits, and contract reviews.
• Identify, document, and prioritize risks related to vendor access, data handling, and system integrations.
• Work with procurement and legal teams to ensure security requirements are included in vendor contracts and SLAs.
• Prepare risk reports for senior leadership, highlighting key vendor risks and mitigation strategies.
• Communicate security expectations to vendors and internal stakeholders.
• Maintain a centralized vendor risk repository with up-to-date documentation.
• Stay updated on emerging threats, regulatory changes, and industry best practices.
• Enhance vendor risk assessment processes and tools for efficiency and effectiveness.
• Cross-train team members on risk management principles.
• Actively participate in the broader corporate security efforts, including infrastructure security, end-user training, and vulnerability management

Qualifications

• Bachelor s degree in Information Security, Cybersecurity, Risk Management, or related field.
• 5+ years of experience in IT risk management, vendor risk assessment, or third-party security evaluations.
• Strong knowledge of security frameworks (NIST, ISO 27001, SOC 2, GDPR, etc.).
• Experience with vendor risk assessment tools
• Strong GRC (Governance, Risk, and Compliance) platform knowledge.
• Familiarity with cloud security, data privacy laws, and contractual security clauses.
• Strong communication and interpersonal skills, with the ability to collaborate effectively with technical and non-technical stakeholders.