Risk Analyst – Vendor Risk Assessment

About the role

SentinelOne is seeking a Risk Analyst focused on Vendor Risk Assessment (VRA) to join its Information Security GRC team. You will apply hands‑on IT and cybersecurity knowledge to evaluate the security posture of a diverse set of vendors and help shape remediation priorities.

Key responsibilities

• Review vendor questionnaire responses, SOC 2 reports, penetration‑test findings, vulnerability disclosures, encryption practices and access‑control configurations.
• Identify technical control gaps and contribute to risk‑prioritized remediation plans.
• Interpret vendor technical documentation such as architecture diagrams, data‑flow maps, hardening standards, patch‑management processes and incident‑response capabilities.
• Map vendor controls to frameworks including ISO 27001, SSAE 18/SOC 2, SOX ITGC, GDPR and NIST CSF/SP 800‑53.
• Collaborate with internal stakeholders to communicate risk findings and support decision‑making.

Required profile

• Strong technical background in IT and cybersecurity with the ability to assess risk accurately.
• Experience evaluating third‑party security controls and interpreting technical documentation.
• Curiosity and commitment to continuous learning in a fast‑evolving AI‑driven security environment.

Required skills

• Vendor risk assessment
• SOC 2, ISO 27001, NIST CSF, NIST SP 800‑53, GDPR, SOX ITGC frameworks
• Analysis of penetration‑test results and vulnerability disclosures
• Understanding of encryption, access‑control, patch‑management and incident‑response practices
• Familiarity with cloud, SaaS, on‑premise and hybrid IT environments