Supplier Cybersecurity GRC Analyst

Job Title - Supplier Cybersecurity GRC Analyst
Location - Cupertino, CA
Contract


Job Description


We are seeking an experienced Supplier Cybersecurity Risk Remote Assessment Coordinator/Manager with a strong cybersecurity and third-party risk management background to support enterprise supplier security assessment initiatives. The ideal candidate will have hands-on experience conducting remote cybersecurity risk assessments for a large volume of vendors/suppliers, strong auditing capabilities, and excellent stakeholder communication skills.


The candidate will work closely with internal security, compliance, procurement, legal, and business teams to evaluate supplier cybersecurity posture, identify risks, and ensure compliance with organizational security standards and regulatory requirements.


Key Responsibilities

• Conduct remote cybersecurity risk assessments for third-party vendors, suppliers, and external partners.
• Manage and coordinate high volumes of supplier security assessments across multiple business units and regions.
• Review vendor security questionnaires, audit reports, policies, certifications, and compliance documentation.
• Evaluate supplier cybersecurity controls related to network security, cloud security, endpoint protection, identity management, data protection, and incident response.
• Analyze vendor risks and identify gaps against organizational cybersecurity standards and frameworks.
• Perform cybersecurity due diligence assessments for new and existing suppliers.
• Collaborate with procurement, legal, compliance, privacy, and security teams during vendor onboarding and renewal processes.
• Track assessment findings, remediation activities, risk exceptions, and mitigation plans.
• Conduct risk analysis and provide recommendations for remediation and risk reduction strategies.
• Support third-party risk governance, audit readiness, and compliance initiatives.
• Review SOC reports, ISO certifications, penetration testing reports, and vulnerability assessment results.
• Communicate cybersecurity risks, findings, and recommendations effectively to technical and non-technical stakeholders.
• Coordinate with suppliers to collect evidence, validate remediation efforts, and ensure timely closure of security gaps.
• Maintain assessment documentation, audit records, dashboards, and reporting metrics.
• Support cybersecurity audits, compliance reviews, and regulatory requirements.
• Stay updated on emerging cybersecurity threats, third-party risk trends, and industry best practices.