Third Party Security Risk Analyst

Key Responsibilities :

• Vendor Security Documentation Review
• Evaluate third-party security artifacts including SOC 2 Type II reports, ISO / IEC 27001 certificates (with Statement of Applicability), vulnerability assessments and penetration testing (VAPT) results, and security policy documentation. Identify gaps or weaknesses in vendor controls and document potential risks for review.
• Technical Capability Assessment
• Analyze vendor capabilities related to identity and access management (SSO, MFA), data protection (encryption at rest / in transit, field-level encryption, masking), integration options (agents or SDKs / libraries, APIs, webhooks, file-based), and logging (support for SIEM integration, event types, delivery mechanisms). Validate alignment with Broadridge standards.
• Stakeholder Communication and Guidance
• Provide subject matter expertise to Business stakeholders evaluating third-party solutions. Help translate security findings into business terms, and support vendor communications to clarify expectations and request missing documentation or clarifications on security capabilities.
• Continuous Improvement and Standardization
• Help refine the interactions between BISG and TPRM and the security assessment process by contributing to standard checklists, risk scoring models, and onboarding workflows. Stay current on emerging third-party security risks and recommend enhancements to evaluation criteria over time.

Required Skills and Qualifications :

Preferred Qualifications :

Skills Required

Penetration Testing, System Analysis, Saas, Information Security, Soc, System Security