Third-Party Security Risk Analyst

A bit about this role Are you looking to build your career in cybersecurity while making a real difference for the members who depend on us? Our Cybersecurity Governance, Risk Management, and Compliance (GRC) team is looking for a Third-Party Security Risk Analyst to help run the day-to-day work of our Third-Party Risk Management (TPRM) program. You'll work alongside senior team members to assess our vendors, document risk, and keep our partnerships secure.

About Devoted

Our robust and seamlessly integrated care platform merges advanced data and AI access with world-class clinical and service experiences to create a member experience that is unlike the industry norm.

To continue building upon our mission, we want to bring together those who share our values, embrace change and advancement, and are enthusiastic about where we're going — all the while bringing their own unique qualities, experiences, and expertise, in hopes of further changing the healthcare experience.

Responsibilities

• It's hands-on work that directly shapes how safely we operate.
• Support the onboarding and reassessment of third-party vendors under the Security purview.
• You'll gather information, document risks, facilitate stakeholder discussions, evaluate inherent and residual risk, and track follow-up actions and remediation activities.
• Perform initial impact assessments on new and existing vendors and assign risk tiers using established criteria, such as data classification, system access, criticality to operations, and regulatory exposure.
• The tier sets the level and cadence of due diligence each vendor requires.
• Carry out standardized third-party risk assessments under the direction of senior team members, including reviewing security questionnaires, SOC reports, and supporting evidence.
• Track assessment status and follow up with risk domain owners so submissions arrive on time.
• Document risk findings and ratings, including inherent and residual risk scores, clearly and consistently.
• Monitor open findings and remediation commitments, and escalate overdue items.
• Help verify that vendor contracts include the required Infosec addendum clauses.
• Help maintain procedures, templates, and guidelines so the program stays organized and repeatable.
• Support internal and external audits of the vendor risk program by preparing evidence and responding to requests.
• Help evaluate AI usage in vendors’ products and services, including how they protect data, manage model and platform risk, and meet contractual and regulatory expectations.
• At the Heart of It You'll execute the full TPRM lifecycle, from initial vendor assessments through ongoing monitoring and offboarding.
• Along the way you'll help third-party services join our ecosystem without compromising our security or our values.
• You'll get direct mentorship from experienced TPRM and security professionals and exposure to Legal, Procurement, Compliance, and ERM.
• You'll also get the chance to grow your skills while contributing to Devoted's resilience against cybersecurity threats.

Requirements

• Practical experience in third-party risk management, vendor management, procurement, information security, compliance, or audit (relevant internships count)
• Basic understanding of third-party risk concepts, governance policies, and common security frameworks (e.g., HITRUST, NIST CSF, ISO 27001, ISO 42001, SOC 2) Exposure to vendor lifecycle procedures, including onboarding, ongoing monitoring, and offboarding
• Exposure to contract clause review for security, privacy, and business resilience controls

Familiarity with findings or vulnerability remediation tracking

• Awareness of software and hardware supply chain risk Strong analytical skills with the ability to interpret data and spot gaps or inconsistencies in vendor responses
• Excellent organizational skills and attention to detail, with the ability to manage multiple assessments at once Strong written and verbal communication skills
• Comfort working cross-functionally with Legal, Finance, Risk, Procurement, and business stakeholders
• Bachelor's degree in risk management, information security, privacy, compliance, business, or a related discipline 3-5 years of experience in a third-party risk management role, including vendor management

Preferred

• Familiarity with cloud security controls and shared responsibility models across major providers (e.g., AWS, Azure, GCP), including how to evaluate a vendor's cloud environment during an assessment
• Awareness of AI-related risks and controls, such as data usage and retention, model transparency, and responsible AI practices, and of emerging frameworks like the NIST AI Risk Management Framework or ISO/IEC 42001 Knowledge of healthcare regulations such as HIPAA and HITRUST Relevant certifications, or progress toward them (e.g., CISA, CIA) Salary Range: $58,000 - $110,000/year The pay range listed for this position is the range the organization reasonably and in good faith expects to pay for this position at the time of the posting.

Pay

Once the interview process begins, your talent partner will provide additional information on the compensation for the role, along with additional information on our total rewards package.

The actual base salary offered will depend on a variety of factors, including the qualifications of the individual applicant for the position, years of relevant experience, specific and unique skills, level of education attained, certifications or other professional licenses held, and the location in which the applicant lives and/or from which they will be performing the job.

Benefits

• Employer sponsored health, dental and vision plan with low or no premium
• Generous paid time off $100 monthly mobile or internet stipend
• Stock options for all employees
• Bonus eligibility for all roles excluding
• Director and above; Commission eligibility for Sales roles

Parental leave program 401K program

• And more.... *Our total rewards package is for full time employees only.
• Intern and Contract positions are not eligible.
• Founded in 2017, Devoted Health is on a mission to dramatically improve the health and well-being of older Americans by caring for everyone like they are family, and that includes our employees.
• We are committed to a safe and supportive work environment in which all employees have the opportunity to participate and contribute to the success of the business.
• Individuals are respected for their skills, experience, and unique perspectives.

Innovation

Support efforts to improve AI-enabled automation into the vendor risk program.

Why Step Into This Role This role is a strong foundation for a career in cybersecurity GRC.

• Devoted is an equal opportunity employer.
• We value diversity and collaboration.
• This commitment is embodied in Devoted’s Code of Conduct, our company values and the way we do business.

As an Equal Opportunity

Employer, the Company does not discriminate on the basis of race, color, religion, sex, pregnancy status, marital status, national origin, disability, age, sexual orientation, veteran status, genetic information, gender identity, gender expression, or any other factor prohibited by law. Our management team is dedicated to this policy with respect to recruitment, hiring, placement, promotion, transfer, training, compensation, benefits, employee activities and general treatment during employment.