Senior Third-Party Risk Management Analyst

Momentive Software

. Maintain Momentive's global inventory of third-party providers, applications, and services from onboarding through termination .

Posted 10/14/2026full-timeRemote • United StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in vendor cybersecurity assessments, regulatory compliance, and risk management, with a strong focus on frameworks such as NIST CSF, PCI DSS, and SOC 2. Capable of leading cross-functional teams and mentoring while maintaining audit-ready documentation and promoting a cybersecurity culture.

Highest-signal resume keywords

Vendor Cybersecurity AssessmentsRegulatory Compliance (PCI DSS, SOC 2, GDPR)Risk ManagementProject ManagementCybersecurity Frameworks (NIST CSF, CIS, CMMC)

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

CybersecurityRisk ManagementAuditComplianceVendor Control AssessmentCloud Technologies (AWS, GCP, Azure)APIsApplication CybersecurityEncryptionNetwork Cybersecurity

Soft Skills

Project ManagementMultitaskingOrganizational SkillsWritten CommunicationVerbal Communication

Tools & Technologies

EGRC/ITGRC Platforms (Jira Service Manager GRC, Archer, OneTrust, LogicGate)SIEMIDSLog ManagementVulnerability Management

Certifications & Qualifications

CISSPCISMCISACRISCCTPRACTPRP

Industry Keywords

NIST CSFCISCMMCGDPRPCI DSSSOC 2GLBAHIPAASOXHITRUST

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityGoogle Cloud Platform

About the role

Key responsibilities & impact

Maintain Momentive's global inventory of third-party providers, applications, and services from onboarding through termination
Lead vendor cybersecurity assessments and coordinate with Cybersecurity Engineering, Legal, and business owners
Assess vendor maturity using NIST CSF, CIS, CMMC, GDPR, PCI DSS, SOC 2, and other frameworks
Oversee vendor SLAs, RPO/RTO commitments, breach notification requirements, and cybersecurity insurance documentation
Document findings, recommendations, and remediation plans for vendor assessments
Liaise with internal and external auditors on vendor-related controls and evidence collection
Provide evidence, documentation, and control validation for SOC 2 Type II and PCI DSS assessments
Ensure vendor controls align with Momentive's ISMS, contractual obligations, and certification requirements
Maintain audit-ready policies, standards, procedures, and risk treatment plans
Track vendor exceptions and compensating controls
Support vulnerability notifications to clients who manage their own cybersecurity controls
Provide consultative guidance regarding risk impact, remediation expectations, and recommended cybersecurity practices
Maintain documentation and metrics related to client notifications, follow-up actions, and closure
Contribute to continual improvement of Momentive's ISMS and cybersecurity controls
Support DR/BCP planning related to vendor dependencies and resiliency requirements
Coordinate with Legal, Cybersecurity, and leadership on vendor-related risk reduction strategies
Promote enterprise-wide cybersecurity culture through outreach, training, and awareness activities
Provide service to internal and external stakeholders
Mentor team members and contribute to internal training materials and documentation

Requirements

What you’ll need

5+ years of experience in cybersecurity, risk management, audit, or compliance
Deep understanding of regulatory requirements including PCI DSS, SOC 2, GDPR, GLBA, HIPAA, SOX, and HITRUST
Experience evaluating both legacy and modern cloud technologies (AWS, GCP, Azure)
Strong knowledge of APIs, application cybersecurity, encryption, endpoint, and network cybersecurity concepts
Familiarity with SIEM, IDS, log management, vulnerability management, and threat intelligence
Ability to assess vendor controls, map them to frameworks, and articulate risk to non-technical stakeholders
Strong project management, multitasking, and organizational skills
Excellent written and verbal communication skills
Experience supporting SOC 2 Type II and PCI DSS audits
Experience with EGRC/ITGRC platforms (e.g., Jira Service Manager GRC, Archer, OneTrust, LogicGate)
Certifications such as CISSP, CISM, CISA, CRISC, CTPRA, or CTPRP
Eligibility to work in the United States without sponsorship
Minimum age of 18

Benefits

Comp & perks

Medical, Dental & Vision Benefits
401(k) Savings Plan with Company Match
Flexible Planned Paid Time Off
Generous Sick Leave
Inclusive & Welcoming Environment
Purpose-Driven Culture
Work-Life Balance
Commitment to Community Involvement
Employer-Paid Parental Leave
Employer-Paid Short-Term Disability
Remote Work Flexibility