Sr. Cyber Governance, Risk & Compliance Analyst

Sr. Cyber Governance, Risk & Compliance Analyst Full-time Workplace Type: Remote Compensation: USD 117,000 - USD 151,000 - yearly What you'll get to do: Third‑Party / Vendor Risk Management (Primary Focus) Design, implement,operate, and continuously mature the Third‑Party Risk Management program, evolving it from a reactive,compliance drivenfunction into a proactive,risk-basedcapability. Execute and oversee the fullthird-partyrisk lifecycle, including onboarding, inherent and residual risk assessments, due diligence, periodic reviews, contract risk review, issue management, remediation tracking, and ongoing monitoring. Perform deep technical security and risk assessments of third parties, including cloud services, SaaS platforms, infrastructure providers, and technology vendors. Review and interpret security assurance artifacts such as SOC 2 Type II reports, penetration test reports, CAIQ, SIG, ISO certifications, and other compliance attestations. Evaluate complex vendor solutions, including API integrations with critical internal systems,cloud nativearchitectures (AWS, Azure, GCP), and AI/ML platforms. Assess andmanagesemergingthird-partyrisks, including artificial intelligence risks such as data provenance, model integrity, data leakage, and secure handling of proprietary or regulated data. Leadend-to-endissue and remediation management, ensuring accountability, effectiveness, andtimelyclosure of identified control gaps. Develop and maintain TPRM standards, playbooks, governance models, escalation paths, and operating procedures aligned with regulatory expectations and business needs. Build and deliver meaningful reporting, dashboards, and metrics that provide leadership with clear visibility intothird-partyrisk posture, trends, and decision points. Privacy & Data Protection (Primary Focus) Support privacy operations, including Data Subject Requests (DSRs), Data Protection Impact Assessments (DPIAs), and data mapping initiatives. Partner with Privacy and Legal stakeholders to assess vendor and internal data processing risks and ensureappropriate safeguardsare in place. Contribute toprivacy relatedrisk assessments, controls validation, and remediation tracking as needed. Cyber Governance, Risk & Compliance (Supporting Responsibility) Support cyber GRC activities, including tracking information security risks, risk exceptions, and remediation plans. Assistwith the implementation and ongoing operation of security and risk management frameworks (e.g., NIST, ISO, SOC 2). Contribute to audit and assurance activities by providing risk assessments, evidence, and clear articulation of control posture. Security Operations & Enablement (Supporting Responsibility) Provide support to information security operations as needed, including incident response activities, impact analysis, andpost incidentfollow‑up. Contribute to security awareness and training initiatives, helping translate risk themes into actionable guidance for the business. Assistwithcross functionalsecurity initiatives during periods of increased demand or emerging risk. Business Partnership & Advisory Serve as a trusted risk advisor to vendor relationship owners and senior stakeholders, reducing their operational burden while preserving clear risk ownership and accountability. Partner closely with Legal, Compliance, Procurement, Technology, and Security teams to synthesize requirements and deliver practical,risk‑appropriatesolutions. Review vendor contracts and summarizerisk‑relevantprovisions, control obligations, and gaps, partnering with Legal to supportrisk‑informedcontract decisions. Escalate material risks, delays, or control gaps thoughtfully and early, framing issues in clear business terms and presentingwell‑definedoptions fordecision‑making. Who you are: 7+ years of progressive experience in Information Security, Third‑Party Risk Management, Vendor Risk Management, GRC, or Operational Risk. Demonstrated experience owning, building, or leading a Third‑Party / Vendor Risk Management program. Bachelor's degree in information security, Computer Science, Business Administration, or a related field or equivalent practical experience. Strong experience conducting security risk assessments, assurance reviews, audits, and remediation management. Deep technical understanding of cloud, SaaS, infrastructure, and AI vendor risk. Hands onexperience reviewing SOC 2, ISO 27001, penetration test reports, CAIQ, SIG, and similar security documentation. Strong written and verbal communication skills, with the ability to translate technical risk intoa clearbusiness context for diverse audiences, including senior leadership. Proven ability to work autonomously, manage competing priorities, and drive outcomes in a fast pacedenvironment. Our investment in you: Health Insurance Savings and Retirement Plan Employee Assistance Program Paid Time Off Wellness & Fitness benefits The salary range for this role is $117,000 per year - $151,000 per year. This role is bonus eligible. Vuori is proud to be an Equal Opportunity/Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law. All your information will be kept confidential according to EEO guidelines. #J-18808-Ljbffr Vuori, Inc.