Vendor Cyber Risk Remediation Analyst

• 3+ years' experience in information security, third‑party risk management, IT audit, controls or remediation management.
• Experience supporting assurance programs: control assessments, risk identification, corrective action planning and remediation.
• Strong technical knowledge of security risks and controls across cloud, SaaS, infrastructure, data security and application resilience.
• Capability to evaluate assurance documentation and frameworks such as ISO 27001, SOC 2, SIG/CAIQ and NIST/COBIT.
• Experience assessing complex vendor solutions (API integrations, cloud‑native services, generative AI platforms) and understanding of AI/ML‑related risks.
• Strong analytical and communication skills; ability to manage multiple findings, deadlines and stakeholder dependencies.
• Professional proficiency in English. Bachelor's degree in cybersecurity, IT, risk management or related field, or equivalent experience.

Preferred

• Experience in global vendor/TPRM programs, ServiceNow or other GRC/TPRM platforms.
• Experience developing remediation metrics, dashboards, procedures or training.
• Relevant certifications such as CISA, CRISC, CISSP, CISM or similar.

Can you imagine taking part in the transformation of leading national and international organizations?

At Deloitte, we are committed to making an impact on society, our clients, and our people.

As part of the Global Cyber Risk team, the Vendor Cyber Risk Remediation Analyst reports into the Vendor Remediation/Third‑Party Risk function and supports Deloitte's global program to evaluate, manage and remediate vendor cybersecurity issues.

In this role you will lead remediation efforts for vendor cybersecurity findings, validate remediation evidence, monitor corrective actions, and coordinate risk treatment decisions with vendors, business stakeholders and security teams across the multi‑firm environment. You will maintain accurate remediation records in the TPRM/GRC platform, produce actionable metrics and dashboards, and contribute to process improvements that mature our vendor cyber risk program.

• Lead end‑to‑end remediation of vendor cybersecurity findings: evaluate remediation plans, validate evidence, and monitor commitments through closure or documented risk treatment.
• Coordinate with vendors, procurement, privacy, legal, business stakeholders and security teams to ensure remediation ownership, risk decisions and supporting rationale are recorded.
• Maintain remediation workflows and vendor risk records in the TPRM/GRC platform (e.g., ServiceNow); produce operational reports and dashboards for leadership.
• Oversee higher‑risk vendors: drive timely remediation, monitor for incidents and perform follow‑up due diligence.
• Support the vendor continuous monitoring program: assess alerts, identify changes in vendor security posture and initiate remediation actions.
• Review assurance artifacts (questionnaires, audit/penetration test reports, certifications) to evaluate vendor control effectiveness.
• Contribute to program maturation through process improvements, automation, governance, guidance and training.