Skip to content
sec/atlas
all careers

careers

Third-Party Risk Analyst

Judge how much to trust the suppliers your company depends on.

A third-party risk analyst assesses the security of vendors, partners and software the company relies on, because their weaknesses become yours. The work blends security knowledge, contracts and process: tiering suppliers, reviewing evidence, and following up until the risk is accepted or reduced.

see this path on the journey map

A day in the job

  • Keep an inventory of vendors and tier them by criticality.
  • Review questionnaires, audit reports and technical evidence for critical suppliers.
  • Negotiate security terms with legal and procurement, such as breach notification and audit rights.
  • Track findings and reassess suppliers on a schedule or after an incident.
0 of 8 studiedNext topic: Security risk management

  1. Stage 1· Foundations

    Learn risk thinking and the standards suppliers are measured against.

    Study here

    Learn elsewhere

    • Basic contract and procurement concepts
    • Privacy law basics for your jurisdictions

    Build this

    Tier ten fictional vendors by criticality and write the review depth each one would receive.

  2. Stage 2· Practitioner

    Assess suppliers and the software supply chain.

    Study here

    Learn elsewhere

    • Reading SOC 2 and ISO 27001 reports critically
    • Security questionnaires and how to challenge vague answers

    Build this

    Review a public SOC 2 style report and write a one-page risk summary with follow-up questions.

  3. Stage 3· Advanced

    Use software inventories and metrics to monitor suppliers continuously.

    Study here

    Learn elsewhere

    • Security ratings services and their limits
    • Incident handling when a supplier is breached

    Build this

    Define a supplier risk dashboard with a handful of metrics and the decision each one informs.

What to show

  • A tiering model and review checklist for suppliers, with the reasoning for each tier.
  • A sample supplier assessment with findings, requested actions and a residual risk rating.

Certifications (examples)

  • CTPRP (Shared Assessments)
  • ISO 27001 Lead Auditor
  • CISA (ISACA)

Examples, not endorsements or requirements. Check the issuer for current details.

Related roles