Security Analyst, Third-Party Ecosystem Risk Management

Runs third-party security risk work in Plaid's Security GRC team, assessing both the vendors Plaid depends on and the customers and partners that connect to its platform. The analyst handles reviews end to end, from intake and questionnaires through risk rating, findings and exceptions, keeps tiering, reassessments, remediation and the risk register up to date, reports program health to Security and other stakeholders, and improves questionnaires, criteria, runbooks and AI-assisted workflows as volume grows.

Plaid wants four or more years in vendor risk management, experience turning SOC 2 and ISO reports into defensible ratings, working knowledge of SOC 2, ISO 27001 and NIST CSF, and a record of maturing a third-party risk program. CTPRP, CISA or CISSP is a plus. Hybrid from the New York office.