Sr. TPRM Security Analyst

Claritev helps make healthcare more transparent and affordable through data, technology, and expertise. The Sr. TPRM Security Analyst will support the company’s GRC program by executing and maturing third-party risk management processes, including vendor security assessments, onboarding, due diligence, monitoring, deficiency management, and risk reporting. The role will also evaluate technical controls and collaborate with internal stakeholders and vendor engineering teams to manage third-party security risks.

Responsibilities:

• Serve as a trusted advisor and subject matter expert, providing third-party risk management and security governance support to Procurement, IT, and business stakeholders throughout the vendor lifecycle
• Support the GRC leader in executing strategy and multi-year roadmaps to mature Claritev’s TPRM program
• Collaborate with security, IT, procurement, privacy, legal, compliance, and business stakeholders to develop standards and processes that protect the confidentiality, integrity, and availability of Claritev data in third-party environments
• Own and execute core TPRM workflows and tooling, including vendor intake and risk tiering, security risk assessment (SRA) scoping, evidence collection, assessment execution, deficiency tracking, risk acceptance, and risk escalation processes
• Conduct in-depth security risk assessments of third-party vendors, including evaluation of system architectures, data flows, authentication mechanisms, encryption implementations, network segmentation, and cloud security controls
• Lead technical discussions with vendor engineering and security teams to validate architectural design, control effectiveness, and alignment with Claritev security requirements
• Review and analyze vendor-provided documentation, including SOC reports, penetration test results, security policies, and completed questionnaires, to assess inherent and residual risk
• Identify control gaps and deficiencies, document findings, and coordinate remediation activities or risk acceptance decisions with business stakeholders
• Track and manage third-party remediation plans through closure, ensuring timely follow-up, appropriate documentation, and audit readiness
• Support ongoing monitoring of third-party risk, including reassessments, periodic reviews, and integration of continuous monitoring tools and threat intelligence sources
• Build and maintain consistent assessment methodologies and templates to improve efficiency, quality, and defensibility of vendor risk evaluations
• Assist with audits and reviews of TPRM processes to evaluate control effectiveness, document findings, and track remediation activities through closure
• Develop and maintain metrics, reporting, and dashboards that communicate third-party risk exposure, assessment volume, deficiency trends, SLA performance, and program effectiveness
• Coordinate with the Risk Management team to ensure material third-party risks are escalated into the enterprise risk register and reporting framework
• Partner with Procurement to ensure alignment between vendor onboarding workflows and TPRM requirements, including integration with procurement systems and contract lifecycle events
• Continuously identify opportunities to improve TPRM processes, automation, and tooling within platforms such as Onspring
• Collaborate, coordinate, and communicate effectively across disciplines and departments, and demonstrate the Company’s Core Competencies and values held within
• The position responsibilities outlined above are in no way to be construed as all encompassing. Other duties, responsibilities, and qualifications may be required and/or assigned as necessary

Requirements:

• At least 5+ years' experience directly in cybersecurity or information security GRC, with a demonstrated track record of leading complex projects in at least two of the following areas: third-party risk management, vendor risk assessments, compliance operations, control assurance, or audit support
• Strong technical background is required, with the ability to interpret and evaluate system architecture diagrams, application data flows, and infrastructure designs across cloud and on-prem environments
• Hands-on or practical experience in one or more technical domains such as cloud engineering, network security, application security, or systems engineering
• Demonstrated ability to engage in detailed technical discussions with engineers and architects regarding control implementation and security design decisions
• Strong working knowledge of cloud architectures (e.g., AWS, Azure), including identity models, network design, data protection mechanisms, and shared responsibility considerations
• Demonstrated experience conducting risk, security, or governance assessments of AI/Generative AI technologies and vendors, including evaluation of data privacy, model security, and responsible AI controls
• A deep understanding of third-party risk assessment methodologies and frameworks, including NIST CSF, HITRUST, HIPAA, SOC 2, ISO 27001, and related security and privacy requirements
• Strong knowledge and experience with the TPRM lifecycle, including vendor intake, tiering, due diligence, risk assessment execution, deficiency management, remediation tracking, and ongoing monitoring
• Experience reviewing and interpreting vendor security artifacts such as SOC reports, penetration tests, security policies, and questionnaire responses
• Experience building and maintaining TPRM reporting, dashboards, and program metrics that support executive-level decision-making
• Strong knowledge of control frameworks, risk identification and assessment techniques, and remediation tracking processes as applied to third-party environments
• Functional knowledge of information security domains, industry standards, and best practices, along with the ability to identify and recommend process improvements and automation opportunities
• Previous experience with GRC solutions such as Onspring, Archer, Lockpath, LogicGate, or similar platforms; hands-on workflow and reporting configuration experience preferred
• Experience collaborating with cross-functional stakeholders such as Procurement, Legal, Compliance, Privacy, Internal Audit, and IT
• Ability to maintain confidentiality of information and exercise sound judgment when handling sensitive matters
• Ability to work independently as well as within a team, communicate effectively with technical and non-technical stakeholders, and influence decisions through clear recommendations
• Ability to organize, prioritize, and coordinate multiple work activities, adapt to changing priorities, and meet target deadlines
• Ability to travel as needed to Company locations and third-party locations within the US
• Individual in this position must be able to work in a standard office environment which requires sitting and viewing monitor(s) for extended periods of time, operating standard office equipment such as, but not limited to, a keyboard, copier, and telephone
• CISSP, CISA, CISM, CRISC, or similar certifications are a plus