Security Risk Analyst Jobs

The key objectives of the TPRM Program are to: Assess the risk of third-party relationships which drive the rigor of risk management activities both during the third-party onboarding and ongoing monitoring lifecycle phases using the TPRM Program’s formula-based risk methodology; Act as a liaison across key internal stakeholder teams (Procurement, Legal, Enterprise Security and the Business) to ensure clear and accurate communication of third-party risks aligned to risk management activities in order to complete risk assessments in a timely manner; Identify TPRM program enhancements aimed at the effective and efficient management of third-party risk in order to support Business strategic initiatives. Reporting to the TPRM Manager and working closely with the TPRM Risk Analyst, the Associate TPRM Risk Analyst will support day-to-day execution of the third-party risk lifecycle. This is a support-oriented analyst role focused on applying established TPRM procedures and risk methodology to standard engagements, maintaining complete and accurate assessment records, coordinating routine stakeholder activity, and escalating issues that require additional judgment. Responsibilities: Risk Intake & Assessment Methodology Apply the TPRM Program’s formula-based inherent risk methodology and assign Criticality designations for standard third-party relationships, documenting the inputs, rationale, and supporting evidence Perform completeness and consistency checks on intake information, risk calculations, and assessment records; identify missing, inconsistent, or unclear information and escalate exceptions in accordance with defined thresholds. Documentation Analysis & SME Coordination Gather, organize, and maintain third-party-provided information and documentation in accordance with TPRM assessment methodology and audit-readiness expectations. Identify and route required SME reviews using defined risk triggers, track responses, and document completed SM

About the Team DoorDash’s Global Governance, Risk and Compliance (GRC) team helps the business scale securely through practical risk-based decisions, reliable controls and clear accountability. Our third-party risk program protects the systems and data behind our marketplace across DoorDash, Wolt, and Deliveroo. About the Role We’re looking for a Third-Party Risk Management (TPRM) Manager to lead a technically rigorous global program and shape its AI-native future. You will own the vendor security risk lifecycle, lead complex assessments of integrations with our most critical systems and data, and develop a team that makes clear, evidence-based risk decisions. You will also set the vision and build practical agentic workflows that improve how we gather evidence, assess risk, and follow through on remediation. Reporting to the Global Head of GRC, you will serve as their US-based deputy and provide GRC leadership and escalation coverage during US business hours. You will directly manage TPRM analysts together with other US-based GRC team members assigned to your organization. This role combines hands-on technical judgment, program ownership and people leadership. You will be based in the United States, preferably within the Eastern or Central timezones, with core working hours aligned to US business needs and clear handoffs with global colleagues. What you will do Run the day-to-day TPRM program operations from vendor discovery and risk tiering through due diligence, onboarding, continuous monitoring, remediation and exit. Maintain a reliable vendor inventory, policies, assessment standards, and service levels across DoorDash, Wolt, and Deliveroo, covering cloud, SaaS, business process outsourcing (BPO), and other critical suppliers. Lead assessments of vendors connected to crown jewel systems, including identity platforms, production cloud, source code and CI/CD, and sensitive-data platforms. Examine architecture, data flows, permissions, and control evidence. Use st

Leidos is seeking a detail-oriented Cybersecurity Analyst with expertise in Security Accreditation to support the assessment, authorization, and continuous monitoring of information systems. The successful candidate will ensure systems comply with government and industry cybersecurity requirements while supporting the organization's Risk Management Framework (RMF) processes. Primary Responsibilities: Lead and support the security accreditation process for information systems. Develop, maintain, and review security authorization packages. Conduct security control assessments in accordance with RMF and applicable security standards. Collaborate with system owners, engineers, and stakeholders to implement security controls. Perform security risk assessments and recommend mitigation strategies. Monitor systems for compliance with cybersecurity policies and standards. Maintain Plans of Action and Milestones (POA&Ms) and track remediation activities. Support continuous monitoring activities, including vulnerability management and security reporting. Prepare documentation for Assessment & Authorization (A&A) activities. Participate in internal and external cybersecurity audits. Stay current on cybersecurity threats, regulatory requirements, and best practices. Basic Qualifications: Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field (or equivalent experience). 3–7 years of experience in cybersecurity, information assurance, or security compliance. Experience implementing or supporting the NIST Risk Management Framework (RMF). Knowledge of: NIST SP 800-37 NIST SP 800-53 NIST SP 800-171 FISMA FedRAMP (preferred) Experience with vulnerability assessment tools such as Tenabl

Every day, tens of millions of people come to Roblox to explore, create, play, learn, and connect with friends in 3D immersive digital experiences– all created by our global community of developers and creators. At Roblox, we’re building the tools and platform that empower our community to bring any experience that they can imagine to life. Our vision is to reimagine the way people come together, from anywhere in the world, and on any device. We’re on a mission to connect a billion people with optimism and civility, and looking for amazing talent to help us get there. A career at Roblox means you’ll be working to shape the future of human interaction, solving unique technical challenges at scale, and helping to create safer, more civil shared experiences for everyone. As a member of the Roblox Security Governance, Risk, and Compliance (GRC) team, you will play a key role in supporting the Security team’s mission. The GRC team is at the heart of Roblox's security organization — empowering every builder to make risk-informed decisions by establishing a portfolio of governing policies and standards, a repeatable and scalable method of assessing and quantifying risk, and a formal oversight process for GRC capabilities across Roblox. Our program takes a balanced, "right-sized" approach to security governance — combining qualitative and quantitative risk management methodologies, including Factor Analysis of Information Risk (FAIR), to assess and prioritize the security risks that matter most to Roblox. GRC partners closely with Engineering, Legal, Finance, and leadership — including providing regular reporting to the Board of Directors and the Audit & Compliance Committee — to ensure that security risk is visible, well-understood, and actioned appropriately. The team is in an exciting phase of growth and innovation. We are using engineering to drive automation across risk management, policy lifecycle management, supply chain risk, AI risk, and controls pr

At Snowflake, we are powering the era of the agentic enterprise. To usher in this new era, we seek AI-native thinkers across every function who are energized by the opportunity to reinvent how they work. You don’t just use tools; you possess an innate curiosity, treating AI as a high-trust collaborator that is core to how you solve problems and accelerate your impact. We look for low-ego individuals who thrive in dynamic and fast-moving environments and move with an experimental mindset — who rapidly test emerging capabilities to discover simpler, more powerful ways to deliver results. At Snowflake, your role isn't just to execute a function, but to help redefine the future of how work gets done. We are hiring a Senior Compliance Analyst, Customer Trust for our SnowTrust GRC team. You will own the full lifecycle of multiple customer-facing and third-party assessments, from defining scope and owning the project plan to driving deliverables across projects with moderate to high business or technical complexity. You will work daily with IT, Business, Procurement, Security, and Compliance teams, and regularly with leadership, to deliver the vendor and customer projects in your portfolio. AS A SENIOR COMPLIANCE ANALYST, CUSTOMER TRUST AT SNOWFLAKE, YOU WILL: Customer Trust Respond to customer due diligence questionnaires and audits about Snowflake's security and compliance obligations. Become an expert on Snowflake's control environment, security features, and best practices for customer deployments. Serve as a trusted advisor on customer and regulator inquiries about Snowflake's security and compliance obligations and documentation. Join sales conversations to explain Snowflake's security and compliance capabilities. Third-Party Oversight, Governance, and Risk Management Conduct security risk assessments of new and existing vendors, evaluating their security posture against contractual, regulatory, and industry requirements. Partner with Legal and Procurement to make su

Momentum is a respected collection of independent companies, including PMG, Koddi, Further. We serve as a premier global business transformation partner for over 125 of the Fortune 500 brands. With 1,400 global employees and $5B in media spend under management, we foster a fast-growing, values-driven, people-first environment where you can thrive. Our portfolio of companies partners with some of the world’s most iconic and ambitious brands. We combine scalability with a solutions-oriented approach to deliver fast-paced, innovative results for our customers while creating meaningful growth opportunities for our teams. If you are looking for opportunities to grow in your career and are passionate about being at the forefront of data and technology, and driving rapid innovation in the future of commerce, we would love to talk with you about joining Momentum. We believe that a culture of belonging, inclusion, and diversity is key to empowering our team members to thrive both personally and professionally. Living out our values is not just a goal; it's a daily practice! For more information, please visit www.momentum.com . The Opportunity We are hiring a Security GRC & Risk Analyst to own the governance, risk, and compliance execution layer across a holding company and portfolio of businesses. This is a build-oriented role with a defined scope: you will be the internal anchor for our SOC 2 Type II audit, NIST CSF remediation roadmap, security policy library, vendor risk program, and client-facing security questionnaires. You will work directly with the Cybersecurity Manager and a vCISO partner, collaborate with the Data Privacy legal team as a peer on overlapping policy areas, and engage regularly with portfolio company stakeholders. A dedicated internal Data Privacy legal team owns regulatory compliance - GDPR, CCPA, breach notification, and data subject rights. This role owns the technical controls layer: the evidence, the frameworks, the audit

At Freddie Mac, our mission of Making Home Possible is what motivates us, and it’s at the core of everything we do. Since our charter in 1970, we have made home possible for more than 90 million families across the country. Join an organization where your work contributes to a greater purpose. Position Overview: The Cyber Security team at Freddie Mac is searching for a strong data analyst to collaborate on developing and administering data security policies as well as safeguarding information, evaluating existing data security procedures and identifying new areas of risk for Freddie Mac. If this role sounds like a fit for your skill set, please read on, apply and learn why there is #MoreatFreddieMac ! Our Impact: We develop and train the enterprise on relevant Identity and Access Management best practices, develop and support automated IAM processes, and develop and implement ongoing IAM efficiency improvements with limited oversight by managers. The role will work closely with Enterprise partners and security control owners on IAM automation development activities and alignment of IAM processes with InfoSec maturity targets as described in the InfoSec Strategy. Your Impact: Senior Data Analyst who can develop and implement new and updated business process automation for all Identity and Access Management activities. Develop and proposes strategies to reduce security risk in the organization by implementing procedural prevention, detection, and response measures, while still enabling positive business outcomes. Comfortable supporting ad hoc data retrieval and analysis requests using SQL queries and Copilot/Excel . Creating audit-ready reference documentation. This role will allow for and support rapid AI-based extrapolation/replication of these services as future automated IAM microservices. Qualifications: Typically, 5 - 7 years

Zscaler (NASDAQ: ZS) accelerates digital transformation so customers can be more agile, efficient, resilient, and secure. The Zscaler Zero Trust Exchange platform protects thousands of customers from cyberattacks and data loss by securely connecting users, devices, and applications in any location. Distributed across 200+ public data centers globally and thousands of private sites at the edge, the SASE-based Zero Trust Exchange is the world’s largest in-line cloud security platform. We believe the future of work is Human + AI and are building an AI-native enterprise where human potential is amplified by machine intelligence to solve the world’s hardest security challenges. Driven by deep customer obsession, we are committed to the mission, outcome, and to each other. We bring these commitments to life through three core behaviors: ownership and collaboration, trust through outcomes and impact, and a challenge culture with ongoing feedback. Ready to make an impact at the company pioneering security transformation in the AI era? Join us at Zscaler. Role We are looking for an Insider Risk Security Engineer to join our team. This is a Remote (United States) role, reporting to the Senior Architect in the Enterprise Security Dept department. Serving as a senior contributor on the Insider Risk program within Enterprise Security, you will take operational direction from the Insider Risk Team Lead while operating with high ownership to refine playbooks, lead detection engineering, mentor junior analysts, and represent the team with HR, Legal, and executive stakeholders. What you’ll do (Role Expectations) Sharpen the Insider Risk Program’s detection capabilities by refining rules to reduce noise, close coverage gaps, and surface high-fidelity alerts in adequate time Perform endpoint and user activity investigations using EDR/XDR, UEBA, and SIEM tools, managing cases end-to-end to create factual timelines Drive the development and iteration of insider Risk investigation playbo

Perplexity is seeking a highly experienced Governance, Risk & Compliance Analyst to join our world-class team. You will help shape our compliance and risk management program. If you are a self-motivated, organized professional with a passion for driving compliance and building customer trust, this is an exciting chance to join a fast-growing startup and help revolutionize the way people search and interact online. What You'll Do Implement and lead frameworks such as SOC2, ISO 27001 and HIPAA. Ensuring compliance with certification requirements Ensure and maintain compliance with GDPR, CCPA, CPRA and other privacy regulations Design and build scalable audit management processes and documentation systems that will support future expansion to additional compliance frameworks Build internal GRC platform and tooling Conduct risk assessments and mitigate data security and compliance risks Write, update and enact policies capturing security, privacy, and AI safety requirements Follow and help shape the AI regulatory and standards landscape to keep the company at the forefront of industry developments and best practices What You'll Bring 6+ years of experience leading engagements in audit and compliance Experience translating complex compliance requirements into scalable automation using AI agents and custom built tooling Worked in high tech companies in cloud-native environments Able to translate complex compliance requirements into clear and actionable work-streams Strong commitment to cross-functional collaboration with IT, Security, GTM, and Engineering Self-motivated, detailed and organized, with a diligent approach to project completion Excellent written, verbal, and interpersonal communication skills

GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. * Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of this role As a Security Analyst on GitLab’s Product Security Vulnerability Operations team, you will help protect GitLab customers by triaging security reports, supporting vulnerability management operations, and coordinating clear communications with security researchers, customers, and internal teams. You will work closely with PSIRT engineers, Vulnerability Management, Security Engineering, Legal, Customer Success, Support, and Communications. This role is an excellent opportunity for an early-career security prfessional who is curious, organized, detail-oriented, and excited to build expertise in product securi

About Bluevine Bluevine is the largest small business banking platform in the U.S., redefining how entrepreneurs manage their money. We create modern financial solutions, from checking and lending to payments and beyond, designed to help small business owners grow, thrive, and take control of their financial future. Our best-in-class technology, advanced security, and deep understanding of the small business community give our customers the confidence to focus on what they do best. Since 2013, we’ve supported more than 750,000 small businesses nationwide. Backed by leading investors like Lightspeed Venture Partners, Menlo Ventures, 83North, and Citi Ventures, our 500+ person global team shares one mission: to give small businesses the financial tools they need to succeed. We’re innovators driven by big ideas, collaboration, and real impact. Here, you’ll have the freedom to take ownership, grow your career, and make a difference for small business owners across America. Ready to shape what’s next? This is a hybrid role . At Bluevine, we pride ourselves on our collaborative culture, which we believe is best maintained through in-person interactions and a vibrant office environment. All of our offices have reopened in accordance with local guidelines, and are following a hybrid model. In-office days will be determined by location and discipline. ABOUT THE ROLE: As a Fraud Risk Quality Assurance Analyst, you play a critical function in ensuring that our Risk Operations align with business goals. The primary focus is on identifying common fraud and risk issues, improving the customer experience, and ensuring procedure compliance. You will achieve this by meticulously monitoring the effectiveness and quality of alert reviews and cases. This involves identifying areas of improvement across Risk Operations. WHAT YOU'LL DO: QA Evaluations : Conducts team audits/evaluations to ensure processes and procedures are properly followed. Follows strict deadlines fo

About Sayari: Sayari is the judgment infrastructure for trustworthy AI in economic security and commercial risk. The Sayari Commercial World Model resolves 11.7B+ primary-source records from 250+ jurisdictions forming the ground truth of global commerce. A Judgment Ontology, encoding over a decade of investigative tradecraft, and Superconductor, an agentic orchestration platform, deliver AI that reasons like an expert analyst, shows its work, and traces every finding to its source. Trusted by U.S. Customs and Border Protection, HM Revenue & Customs, and Fortune 500 enterprises, Sayari is used by thousands of professionals across 35+ countries to secure supply chains and dismantle illicit networks. Headquartered in Washington, D.C., with offices in London, Singapore, Tokyo, and Tel Aviv. About the Role Sayari’s customers buy answers to hard problems: who really owns a supplier, where a sanctioned network is moving goods, which alerts deserve an analyst’s time. Sayari’s AI platform Superconductor delivers those answers at machine scale. It is built in the field, with analysts and engineers working alongside customers to define what it needs to do. The Field Intelligence Analyst brings Sayari’s tradecraft to that work. You scope the problem, design the solution, prove its value, and deliver mission impact. You own the analytical relationship for a portfolio of accounts, from first conversation through sustained delivery. What you learn on live engagements flows back into Superconductor and into Sayari’s tradecraft standard. You work in our Field Intelligence Department, a global team of analysts deployed to support government agencies and Fortune 500 companies. You sit in the same org as Forward Deployed Engineers and the Product team. The field shapes the roadmap, and Product sets it. Why This Role Exists Customers buy answers. Superconductor reasons like an expert analyst at machine scale. The analyst’s job shifts from producing every answer by hand

About Sayari: Sayari is the judgment infrastructure for trustworthy AI in economic security and commercial risk. The Sayari Commercial World Model resolves 11.7B+ primary-source records from 250+ jurisdictions forming the ground truth of global commerce. A Judgment Ontology, encoding over a decade of investigative tradecraft, and Superconductor, an agentic orchestration platform, deliver AI that reasons like an expert analyst, shows its work, and traces every finding to its source. Trusted by U.S. Customs and Border Protection, HM Revenue & Customs, and Fortune 500 enterprises, Sayari is used by thousands of professionals across 35+ countries to secure supply chains and dismantle illicit networks. Headquartered in Washington, D.C., with offices in London, Singapore, Tokyo, and Tel Aviv. About the Role Sayari’s customers buy answers to hard problems: who really owns a supplier, where a sanctioned network is moving goods, which alerts deserve an analyst’s time. Sayari’s AI platform Superconductor delivers those answers at machine scale. It is built in the field, with analysts and engineers working alongside customers to define what it needs to do. The Field Intelligence Analyst brings Sayari’s tradecraft to that work. You scope the problem, design the solution, prove its value, and deliver mission impact. You own the analytical relationship for a portfolio of accounts, from first conversation through sustained delivery. What you learn on live engagements flows back into Superconductor and into Sayari’s tradecraft standard. You work in our Field Intelligence Department, a global team of analysts deployed to support government agencies and Fortune 500 companies. You sit in the same org as Forward Deployed Engineers and the Product team. The field shapes the roadmap, and Product sets it. Why This Role Exists Customers buy answers. Superconductor reasons like an expert analyst at machine scale. The analyst’s job shifts from producing every answer by hand

About Sayari: Sayari is the judgment infrastructure for trustworthy AI in economic security and commercial risk. The Sayari Commercial World Model resolves 11.7B+ primary-source records from 250+ jurisdictions forming the ground truth of global commerce. A Judgment Ontology, encoding over a decade of investigative tradecraft, and Superconductor, an agentic orchestration platform, deliver AI that reasons like an expert analyst, shows its work, and traces every finding to its source. Trusted by U.S. Customs and Border Protection, HM Revenue & Customs, and Fortune 500 enterprises, Sayari is used by thousands of professionals across 35+ countries to secure supply chains and dismantle illicit networks. Headquartered in Washington, D.C., with offices in London, Singapore, Tokyo, and Tel Aviv. About the Role Sayari’s customers buy answers to hard problems: who really owns a supplier, where a sanctioned network is moving goods, which alerts deserve an analyst’s time. Sayari’s AI platform Superconductor delivers those answers at machine scale. It is built in the field, with analysts and engineers working alongside customers to define what it needs to do. The Field Intelligence Analyst brings Sayari’s tradecraft to that work. You scope the problem, design the solution, prove its value, and deliver mission impact. You own the analytical relationship for a portfolio of accounts, from first conversation through sustained delivery. What you learn on live engagements flows back into Superconductor and into Sayari’s tradecraft standard. You work in our Field Intelligence Department, a global team of analysts deployed to support government agencies and Fortune 500 companies. You sit in the same org as Forward Deployed Engineers and the Product team. The field shapes the roadmap, and Product sets it. Why This Role Exists Customers buy answers. Superconductor reasons like an expert analyst at machine scale. The analyst’s job shifts from producing every answer by hand

About Sayari: Sayari is the judgment infrastructure for trustworthy AI in economic security and commercial risk. The Sayari Commercial World Model resolves 11.7B+ primary-source records from 250+ jurisdictions forming the ground truth of global commerce. A Judgment Ontology, encoding over a decade of investigative tradecraft, and Superconductor, an agentic orchestration platform, deliver AI that reasons like an expert analyst, shows its work, and traces every finding to its source. Trusted by U.S. Customs and Border Protection, HM Revenue & Customs, and Fortune 500 enterprises, Sayari is used by thousands of professionals across 35+ countries to secure supply chains and dismantle illicit networks. Headquartered in Washington, D.C., with offices in London, Singapore, Tokyo, and Tel Aviv. About the Role Sayari’s customers buy answers to hard problems: who really owns a supplier, where a sanctioned network is moving goods, which alerts deserve an analyst’s time. Sayari’s AI platform Superconductor delivers those answers at machine scale. It is built in the field, with analysts and engineers working alongside customers to define what it needs to do. The Field Intelligence Analyst brings Sayari’s tradecraft to that work. You scope the problem, design the solution, prove its value, and deliver mission impact. You own the analytical relationship for a portfolio of accounts, from first conversation through sustained delivery. What you learn on live engagements flows back into Superconductor and into Sayari’s tradecraft standard. You work in our Field Intelligence Department, a global team of analysts deployed to support government agencies and Fortune 500 companies. You sit in the same org as Forward Deployed Engineers and the Product team. The field shapes the roadmap, and Product sets it. Why This Role Exists Customers buy answers. Superconductor reasons like an expert analyst at machine scale. The analyst’s job shifts from producing every answer by hand