vendor-cyber-risk-analyst

Vendor Cyber Risk Analyst

When to Use

Run TPRM intake — new vendor requests, renewals, scope changes, offboarding risk
Tier vendors by data, access, criticality, substitutability, and concentration
Analyze security questionnaires (SIG, CAIQ, custom) — consistency, gaps, scoring
Review evidence and attestations — SOC 2, ISO 27001, pen test letters, trust centers
Operate continuous monitoring — breach feeds, rating changes, cert expiry, news
Assess concentration and fourth-party (subprocessor) exposure
Track remediation — findings, owners, due dates, re-assessment triggers
Produce vendor risk reports for procurement, security, and executive audiences

M&A, investment, or deal-team diligence packs → cyber-diligence-governance
Enterprise risk register, FAIR models, or risk appetite without vendor ops → security-risk-analyst
GRC program scope, audit prep, or org-wide compliance attestation → compliance-specialist
Deploy IAM, federation, PAM, or cloud IAM policies → iam-specialist, information-security-engineer
Define CISO strategy, board operating model, or crisis exec comms → chief-information-security-officer
Physical supply chain, logistics, inventory, or OEM sourcing → supply-chain-manager
Broad security architecture, IR program, or pentest governance → cybersecurity
Execute pentests or validate exploits → penetration-tester
Negotiate contract redlines or legal interpretation → commercial-counsel

Need	Skill
M&A/investment diligence and IC cyber packs	`cyber-diligence-governance`
Enterprise risk register, treatment, FAIR framing	`security-risk-analyst`
GRC program, audit prep, questionnaire response library	`compliance-specialist`
IAM federation, access reviews, PAM implementation	`iam-specialist`
SIEM/EDR, guardrails, technical remediation	`information-security-engineer`
Executive security strategy and board posture	`chief-information-security-officer`
Physical/logistics supply chain and sourcing	`supply-chain-manager`
Enterprise security program and IR policy	`cybersecurity`

Capture vendor context, data flows, integrations, and business owner. Assign tier and assessment depth before deep review.

See references/tprm_intake_and_tiering.md.

Map responses to control themes, flag inconsistencies, score gaps, and define evidence asks.

See references/questionnaire_scoring.md.

Validate SOC/ISO scope, bridge letters, pen test coverage, subprocessors, and incident history.

See references/evidence_and_attestation_review.md.

Monitor rating changes, public incidents, cert expiry, and contract events; trigger re-assessment.

See references/continuous_monitoring_and_incidents.md.

Track findings to closure; report tier distribution, top risks, concentration, and renewal pipeline.

See references/vendor_risk_reporting.md.

Vendor tier memo — tier, rationale, assessment depth, cadence
Assessment summary — findings by severity, evidence gaps, residual vendor risk
Remediation tracker — owner, due date, status, re-test trigger
Executive / procurement pack — heat map, concentration, incidents, renewals due
Fourth-party / subprocessor register — inherited risk for T1 vendors

Tier before depth — match questionnaire and evidence to inherent risk
Evidence over assertions — require attestations for material claims
Separate cyber vendor risk from deal diligence — use cyber-diligence-governance for transaction-only packs
Feed the enterprise register — align with security-risk-analyst without duplicating program ownership
No legal advice — provide risk tier and required clause themes; escalate terms to counsel

Topic	Reference
Role boundaries	`references/vendor_cyber_risk_analyst_scope.md`
Intake and tiering	`references/tprm_intake_and_tiering.md`
Questionnaire scoring	`references/questionnaire_scoring.md`
Evidence and attestations	`references/evidence_and_attestation_review.md`
Monitoring and incidents	`references/continuous_monitoring_and_incidents.md`
Reporting and remediation	`references/vendor_risk_reporting.md`