Third Party Security Risk Specialist

Job Description and Duties

The CalSTRS Office of the General Counsel is seeking a motivated individual to work as an Information Technology Specialist II in the Information Security Office.

Under the direction of the Teachers' Retirement Board and the administrative direction of the Chief Executive Officer, the Office of the General Counsel provides advice on legal issues as they affect the overall programs and policies of California State Teachers Retirement System (CalSTRS), manages CalSTRS legal program, and represents the System in litigation, appeals, and other legal matters.

The Office of the General Counsel is comprised of multiple highly visible and complex business areas: Office of Legal Ethics & Accountability, Enterprise Information Management & Legal Operations, Information Security Office, Legal Services, Investment Counsel, and Litigation Services.

The Information Security Office (ISO) is CalSTRS' authority on information security and cybersecurity matters. The Information Security Office protects CalSTRS data assets from unauthorized access, use, misuse, disclosure, destruction, modification, or disruption. Read about the programs in ISO below.

Under the general direction of the Information Technology Manager I, the Third-Party Security Risk Specialist serves as a senior level technical specialist responsible for the development, execution, and continuous improvement of the organization’s Third-Party Security Risk Management program. The incumbent performs complex technical and analytical work with attention to details and innovative problem solving to evaluate vendor security controls, manage ongoing compliance activities, support risk governance processes, and ensure third party technologies meet CalSTRS’ minimum information security requirements and controls. This position is in the Information Security Engineering and System Engineering domains.

The ideal candidate will possess the following skills:

• Ability to apply excellent time management skills used for efficient completion of tasks; prioritize competing assignments; and meet deadlines.
• Ability to act with integrity and maintain confidentiality.
• Ability to assess third party cybersecurity audit reports (SOC 1; SOC 2; SOC 3; ISO/IEC 27001), questionnaires (SIG, CAIQ), penetration test results, and vulnerability data to evaluate third-party security risks and compliance.
• Demonstrated ability to take initiative, analyze complex problems, draw sound conclusions, and make clear and concise recommendations.
• Experience coordinating across legal, procurement, and IT teams to facilitate secure vendor onboarding and offboarding.
• Ability to build or scale security risk assessment methodologies, policies, and workflows.
• Experience applying information security and cybersecurity best practice standards: ISO 27001/27002, CIS20; NIST 800-53; NIST CSF, California State Administrative Manual; State and Federal laws or regulations regarding cybersecurity and privacy.
• Ability to communicate effectively, both orally and in writing, with all levels of staff and management.

Every 12 months, based on performance evaluation, employees may receive a 5% salary increase until they reach the maximum salary for the position.

In July 2025, the State of California implemented the Personal Leave Program 2025. This program reduces employees’ monthly base pay in exchange for paid leave credits. This position is subject to PLP 2025 and will have a monthly base pay reduction of 3% in exchange for 5 hours of leave credits for the duration of the program. The salary ranges shown on this job posting do not reflect the reduced amounts.

Does this opportunity seem right for you? If so, see the  Application Instructions  section below and apply now.

You will find additional information about the job in the .

Working Conditions

CalSTRS offers a hybrid approach including in-office and remote work solutions based on business needs.

All staff of CalSTRS are employees of the State of California and subject to California employment taxes and withholdings. Upon appointment, staff are required to provide a current California address to CalSTRS Human Resources to be used as a remote work location.

This position is not eligible for visa sponsorship. Applicants must be authorized to work in the US without the need for visa sponsorship by the start date of employment with CalSTRS.

Special Requirements

Statement of Qualifications

Interested individuals must submit a Statement of Qualifications (SOQ) in addition to the standard state application (form STD 678). Your SOQ will be considered the first interview for this position. If your qualifications are competitive, you will be invited to an interview. When completing the SOQ, please include all relevant experience, education, and training, as applicable, and explain all answers thoroughly. Your SOQ should not exceed two pages, single-spaced, 12-point font, and address the following questions:

1. Describe your experience providing security consultation services when evaluating a technology solution's suitability. Include how you determine which security controls apply and your approach to managing residual risks.
2. Describe your experience using third-party risk management technology solutions. Include your role and how you used these tools to address and control cybersecurity risks.

Exam

This position requires a current Information Technology Specialist II examination. If you need to take the examination or if your score has expired, click here to gain list eligibility.

CalSTRS Personal Trading Program

Investment Branch employees are required to participate in the CalSTRS Personal Trading Program which allows CalSTRS to monitor employees’ personal trading transactions in order to reduce risks associated with insider trading, front running, and misusing material non-public information. Upon accepting a position within the Investment Branch, you will be required to disclose your personal broker account information and be required to utilize a personal broker from a designated list as provided by CalSTRS.

Background Investigation

Prior to employment with CalSTRS, a background investigation (BI) will be conducted. The BI consists of a Personal History Statement and fingerprinting through the Department of Justice. The BI will check criminal and civil records and, if applicable, verify education and check driving records.

CalSTRS Disclosure Requirements

This position may be subject to disclosure and disqualification requirements concerning economic conflict of interest in government work, including the Conflict of Interest Code that applies to CalSTRS team members and the Political Reform Act , which require disclosure of certain investment information and use of a designated trading platform for securities transactions, as well as filing a Statement of Economic Interest (Form 700) .

Incompatible Activities

This position is subject to the provisions of Government Code Section 19990 . Upon accepting a position at CalSTRS, you will also be required to comply with the CalSTRS Incompatible Activities Policy by ensuring that outside work or activities are compatible and align with your professional activities or workplace obligations.

Benefits

CalSTRS offers a competitive pay schedule and a work-life-balance for all its employees. The State of California provides comprehensive benefits packages determined by the employee’s bargaining unit and conditions of employment. Some benefits include:

• Alternative work schedules
• Flexible work hours
• Remote work options
• Medical benefits, including health, dental and vision insurance
• Paid holidays and a defined benefit retirement program
• More than four weeks of vacation/sick leave for leaders
• More than three weeks of vacation/sick leave for staff
• Health insurance in retirement
• Employee Assistance Program
• Loan forgiveness under the federal 

For the latest information on the benefits offered by the state of California, explore the Health Benefits Summary provided by CalHR .

ADDITIONAL APPLICATION INSTRUCTIONS

• Electronic applications through your CalCareer account are highly recommended.  If you are unable to apply electronically through your CalCareer account, please mail or drop off a hard copy of your application packet. Please provide the following information on your application: 815-106-1414-010, RPA: 1011, JC-526174.
• If education is being used to meet the minimum qualifications, please submit a copy of your transcripts/degree.
• Training and Development (T&D) assignments may be considered for this position. If you are applying as a T&D, please indicate this in the eligibility section of your application.
  
• Candidate may be selected by application packet review only.
• Multiple positions may be filled from this&nbcruitment.
• Submission of an incomplete STD 678 may result in disqualification. 

Required Application Package Documents

The following items are required to be submitted with your application. Applicants who do not submit the required items timely may not be considered for this job:

• Current version of the State Examination/Employment Application STD Form 678 (when not applying electronically), or the Electronic State Employment Application through your Applicant Account at All Experience and Education relating to the Minimum Qualifications listed on the Classification Specification should be included to demonstrate how you meet the Minimum Qualifications for the position.
• Resume is required and must be included.
• Statement of Qualifications - A Statement of Qualifications is required. Please see the Special Requirements section of the job posting for detailed instructions.