Senior Analyst

EVOCS OVERVIEW EVOCS was founded with a clear purpose: to help businesses operate more effectively, solve complex challenges, and create opportunities for growth through practical expertise and technology solutions. As an IT consulting firm, we work with our clients to understand their needs, identify the right technologies, and deliver solutions that improve performance and support their business objectives. Today, EVOCS is a trusted technology partner to a growing number of organizations and industry leaders. Our team combines technical expertise, business understanding, and a commitment to quality to deliver effective solutions and build lasting client relationships based on responsiveness, consistency, and results. Senior TPRM Analyst As a Senior TPRM Analyst, you are the experienced hand on the third-party risk team. You own the complex vendor reviews - the cloud providers, MSPs, and critical technology vendors where a shallow assessment creates real exposure - and you are the person escalations land on when a finding is contested or a risk needs to be accepted at the leadership level. You are also the one who writes what goes up. Executive-ready risk summaries, escalation memos, and risk acceptance recommendations come from you, and they need to be right the first time. This is a senior individual contributor role: depth of judgment, not headcount, is what makes you effective here. We are hiring two Senior TPRM Analysts. What You Will Do Vendor Risk Assessment and Due Diligence Own end-to-end risk assessments for the highest-criticality third parties, including cloud service providers, managed service providers, and critical technology vendors Read SOC 2 Type II reports and ISO 27001 certificates for what they actually say - scope carve-outs, excluded systems, qualified opinions, exceptions in the testing results, and complementary user entity controls - rather than confirming that a document exists Evaluate control evidence, penetration test summaries, remediation plans, and security questionnaire responses, and challenge answers that do not hold up Set inherent and residual risk ratings, define compensating controls, and track remediation commitments to closure Assess vendor security posture in context: data classification, access model, integration depth, and business criticality Fourth-Party and Supply Chain Analysis Map fourth-party and subcontractor dependencies behind critical vendors, including where the work is actually performed Analyze vendor concentration risk and identify single points of failure across the third-party portfolio Assess geopolitical and jurisdictional exposure, including offshore delivery locations, data residency, and sub-processor chains Incorporate security ratings and continuous monitoring signals into ongoing vendor risk views, and separate real signal from noise Escalation, Reporting, and Governance Serve as the escalation point for contested findings, vendor pushback, and time-pressured reviews tied to contract or go-live deadlines Write executive-ready risk summaries that state the risk, the business impact, and the recommendation in language leadership can act on Run risk acceptance conversations with senior business, technology, and procurement stakeholders - documenting the decision, the owner, and the expiration Present third-party risk posture, trends, and exceptions to governance forums and senior leadership Support and improve the TPRM program itself: assessment standards, tiering criteria, evidence requirements, and playbooks that raise the floor for the whole team Mentor junior analysts on evidence review, write-up quality, and stakeholder handling What You Will Bring The top candidate will have the following qualifications: 7+ years of experience in cybersecurity, risk, audit, or compliance At least 5 of those years in third-party risk management or vendor risk specifically Demonstrated experience assessing cloud providers, MSPs, and critical technology vendors - not only routine or low-criticality suppliers Fluency reading SOC 2 reports and ISO 27001 certifications, including the ability to identify scope carve-outs, qualified opinions, and control exceptions Fourth-party and supply chain risk analysis: vendor concentration, criticality tiering, geopolitical exposure, and subcontractor dependencies Proven ability to write executive-ready risk summaries for senior audiences Experience leading escalation and risk acceptance conversations with senior stakeholders, including holding a position under pressure Working knowledge of common control frameworks - NIST CSF, NIST 800-53, ISO 27001/27002, CIS - and how they map to vendor assessments Strong interpersonal and communication skills - this role involves frequent interaction with vendors and internal stakeholders via email, calls, and meetings Key Skills and Competencies Third-party and vendor risk assessment Audit repor #J-18808-Ljbffr