xAI Sr. Security Analyst focused on third-party risk management to own and scale the vendor risk program at SpaceXSI. Manages the full lifecycle of third-party risk assessments, due diligence, monitoring, and offboarding across diverse vendor types.
Responsibilities
Own the end-to-end third-party risk lifecycle — intake, inherent risk tiering, due diligence, risk decisioning, contracting support, ongoing monitoring, and offboarding — for vendors and partners across the company
Design and maintain the risk-tiering methodology and inherent risk questionnaire based on data sensitivity, system and network access, business criticality, and regulatory exposure, so that assessment depth matches actual risk and lower-risk vendors move quickly
Conduct security, privacy, and business due diligence: issue and review security questionnaires (e.g., SIG, CAIQ, custom assessments), evaluate architecture diagrams and data flows, run follow-up sessions with vendor security teams, and coordinate business checks such as corporate registration, reputational review, and insurance coverage with cross-functional partners
Critically review independent assurance reports and security documentation, including SOC 1/SOC 2 Type II reports, ISO 27001 and ISO 42001 certificates and Statements of Applicability, penetration test and vulnerability summaries, and bridge letters. Evaluate scope, carve-outs, exceptions, and complementary user entity controls (CUECs) that SpaceXSI must operate
Translate findings into clear risk decisions: weigh residual risk and compensating controls, recommend approval, conditional approval, or rejection, and document risk exceptions and risk acceptances with clear rationale, owners, and expiration dates
Partner with Legal and Procurement to define and negotiate contract security terms, including security and data protection exhibits, DPAs, breach notification, right-to-audit, sub-processor clauses, and data retention and deletion requirements, and ensure SpaceXSI's compliance obligations flow down to vendors and sub-processors
Assess the risk of AI vendors and AI-enabled services, including model and data handling, training-data use and boundaries, prompt and output controls, data residency, and alignment with AI governance frameworks (e.g., NIST AI RMF, ISO 42001, EU AI Act)
Oversee fourth parties and sub-processors: map critical downstream dependencies, track sub-processor changes, and assess concentration, business continuity, and supply-chain risk for critical vendors
Run continuous monitoring of the vendor population using security ratings, breach and threat intelligence, certification expirations, and tier-based reassessment cadences, and lead third-party response when a vendor has a security incident
Maintain the third-party risk register and track issues, findings, and remediation plans with vendors and internal owners through to closure, with defined SLAs and escalation paths
Operate and extend GRC platforms (e.g., Vanta) as the system of record for vendor inventory, assessments, and evidence; use automation, scripting, low-code, and AI-assisted workflows to streamline intake, tiering, questionnaire review, evidence collection, and reassessment
Develop and maintain TPRM policies, standards, procedures, and runbooks that align with SpaceXSI's control environment and frameworks such as SOC 2, ISO 27001, ISO 42001, and NIST CSF / SP 800-53, and support internal and external audits with third-party evidence
Qualification
Bachelor's degree in computer science7+ years of third-party riskExperience building
Required
Bachelor's degree in computer science, information security, cybersecurity, or in an engineering/STEM discipline
5+ years of experience in third-party risk management, vendor security, cybersecurity GRC, IT audit, or a role in security, with hands-on responsibility for performing assessments rather than only administering a program
Preferred
7+ years of third-party risk, vendor security, cybersecurity GRC, or technology audit experience (mid-to-senior scope)
Experience building, scaling, or maturing a TPRM program at a technology, cloud, AI, or fintech company, ideally in a high-growth environment
Demonstrated experience running vendor security assessments end to end across a diverse vendor population, including issuing questionnaires, evaluating evidence, assigning risk ratings, and driving remediation
Hands-on experience reviewing SOC 2 reports, ISO 27001 certifications, and penetration test summaries, including identifying scope limitations, carve-outs, exceptions, and CUECs
Solid understanding of common security and compliance frameworks (e.g., SOC 2, ISO 27001, NIST CSF, NIST SP 800-53) and how vendor controls map to them
Working technical fluency on-prem and in cloud environments (AWS, GCP, or Azure), SaaS architectures, identity and access management, encryption, data flows, incident response, and business continuity and disaster recovery — enough to evaluate vendor responses and speak credibly with engineers and vendors
Experience partnering with Legal and Procurement on vendor contract security and privacy terms (e.g., security addendums, DPAs)
Strong written and verbal communication skills, with the ability to explain risk and tradeoffs to procurement, legal, engineering, and business audiences
