Senior Third Party Risk (TPRM) Cybersecurity Analyst

Description

The company is a large healthcare business that supplies products, services and insights that help make care more accessible and affordable.

The team is working to strengthen security, resilience and governance across its vendor and supplier base.

This is a senior information security analyst role inside a regulated, enterprise-scale setting.

Responsibilities

• Design, improve and oversee third-party risk processes, standards, workflows and reports.
• Lead in-depth security assessments of vendors, covering control reviews, inherent and residual risk, and checking that remediation was done.
• Measure vendor cybersecurity posture against recognised frameworks, regulatory expectations and internal security requirements.
• Work with procurement, legal, privacy, compliance, technology and business teams so risk insights shape decisions across the vendor lifecycle.
• Build continuous monitoring for critical vendors, covering risk indicators, issue tracking, reporting and escalation.
• Turn complex cyber risk findings into clear, practical recommendations for both technical and non-technical readers.
• Prepare executive-level reports, metrics, dashboards and risk summaries that improve visibility of third-party cyber risk.
• Coach peers and help keep assessment practices consistent and scalable across the program.

Requirements

• At least 7 years in cybersecurity, third-party risk, vendor security assessment, technology risk or a closely related technical field.
• Hands-on experience running vendor security assessments, third-party risk reviews, or cyber risk and control assessments.
• Experience reviewing cybersecurity controls, identifying risk, writing up findings and recommending fixes.
• Working knowledge of frameworks such as NIST, ISO 27001, SOC 2, HITRUST, CIS or similar.
• Experience working with cross-functional partners such as procurement, legal, privacy, compliance, technology or business teams.
• Ability to write clear documentation, risk summaries and communications for stakeholders.
• A bachelor's degree or an equivalent mix of education and experience.
• Optional: experience designing or improving a third-party risk program, governance model or assessment method.
• Optional: experience with continuous monitoring, vendor risk scoring, issue management, SLA tracking or cyber risk dashboards.
• Optional: familiarity with healthcare, life sciences, financial services or other regulated environments.
• Optional: experience assessing cloud or SaaS providers, data security, access management, incident response, business continuity, or privacy and security obligations.
• Optional: certifications such as CISSP, CISM, CRISC, CISA, CCSP, Security+ or similar.
• Optional: experience with GRC, vendor risk management, workflow or reporting tools.
• Optional: strong analytical thinking, ability to influence stakeholders and comfort working through ambiguity.

Conditions

The work arrangement may be remote, hybrid or office-based, depending on business and team needs.

Occasional travel may be required for team, stakeholder, vendor or business meetings.

The role generally requires regular computer use and taking part in virtual or in-person meetings.

The base pay range is €72,800 to €121,300.

Pay is set by performance, experience and skills, equity, regular market reviews and geographic market, and an annual bonus or long-term incentive may also be offered.

The company is an equal opportunity employer and follows applicable pay regulations.

Recruiting scam warning: recruiters will never ask for money or card details, do not contact candidates through chat rooms or personal email accounts, and official postings appear only on the careers site.

Benefits

• A Total Rewards package with comprehensive benefits covering physical, mental and financial well-being.