The questionnaire came back in four days, which was the first odd thing. Hundreds of controls, and the supplier had answered "Yes" to every one of them: encryption at rest, quarterly access reviews, a tested disaster recovery plan, background checks for contractors. Even the data center questions got a "Yes" from a company that does not own a data center. A junior reviewer might file that as low risk and move on. Someone who has done the work for a few years reads it as a document written by a sales team in a hurry, and starts asking for evidence. That instinct is exactly what the employer is hiring. Among remote third-party risk analyst jobs, this one is full-time and salaried at $90,000 USD per year, with your home office in whichever country you live in.
The short version of the third-party risk analyst job description: you review vendor security questionnaires and SOC 2 reports, watch external ratings in SecurityScorecard and BitSight, assign each supplier a risk tier, and chase suppliers and internal owners until the gaps you found are actually closed.
Advertisement
Opening the vendor file: intake and inherent risk
Every file starts with a request from someone inside the business who has already chosen the supplier and wants you to agree quickly. Your first job is to work out what the vendor will actually touch. Will it hold customer data, and how much? Will it connect to internal systems? Could the business keep running for a week if this supplier disappeared? Answers to those questions give you inherent risk, the risk before anyone has looked at a single control.
Requesters are optimists. "No sensitive data" sometimes means "we have not asked yet."
Tiering: deciding who gets the long questionnaire
Not every supplier deserves the same scrutiny, and pretending otherwise buries the team. A catering firm that never sees a login doesn't need the same review as a payroll processor holding every employee's bank details. Assign tiers based on data sensitivity, system access, how hard the vendor would be to replace, and any regulatory angle. The tier decides how deep the review goes and how often the file reopens.
Tiering is where judgement shows. Rate everything high, and the review queue collapses. Rate too generously and the risky ones slip through looking ordinary.
The questionnaire, read with a skeptical eye
Back to the all-"Yes" response. The useful questions sit between the answers. If the vendor claims multi-factor authentication everywhere, does that cover their support staff's admin console? If backups are tested, when, and is there a record? Compare answers against each other, too: a supplier that says it has no subprocessors and then mentions a hosting provider in the next section has just told you something.
Good follow-up questions are short and specific. "Please share the date and summary of your last restore test" gets a better answer than "please elaborate on your backup controls."
Reading a SOC 2 report past the opinion letter
Plenty of people stop at the auditor's opinion. The interesting parts are further in. Check the scope first: which systems, which locations, which trust services criteria. A report that covers the vendor's corporate laptops but not the platform you are buying is a nice document about something else. Check the period, and whether it is a Type I (design at one point in time) or Type II (operating effectiveness over months).
Then read the exceptions in the testing section, and the vendor's response to each. One missed access review may be trivial; the same exception two years running is a pattern. Finally, find the complementary user entity controls. These are the things the auditor assumes your organization is doing, such as managing your own user accounts in the vendor's tool. If nobody internally is doing them, part of the clean report quietly stops applying to you, and someone needs to be told.
Outside-in ratings in SecurityScorecard and BitSight
Questionnaires describe what a vendor says. SecurityScorecard and BitSight show some of what the internet can see: exposed services, certificate problems, patching signals, leaked credentials. A falling score is a reason to ask questions, not a verdict; the platforms sometimes map assets to the wrong company, and part of the job is spotting that before you send an alarming email.
Programs are commonly run in a platform such as OneTrust or Prevalent, where intake, questionnaires, evidence, and findings live together.
Remediation: the follow-up email nobody wants to send
Findings mean nothing until someone fixes them. You will agree remediation actions with suppliers, set dates, record accepted risks with the right internal owner's name, and keep following up. Some vendors close gaps quickly. Others respond to the third reminder with a new account manager. Keep a tidy tracker: the file returns at renewal, and the next reviewer (possibly you) will want to know what was promised.
How remote third-party risk analyst jobs run on deadlines
In remote third-party risk analyst jobs worldwide, other people set the calendar. Procurement wants a contract signed by quarter end, a renewal is due on a date nobody mentioned, a business unit discovers it needs a vendor live next week. Third-party risk analyst work-from-home jobs suit people who can protect quiet hours for a long SOC 2 report while staying reachable for urgent requests. Colleagues and suppliers sit across time zones, so clear written updates beat quick calls. The third-party risk analyst salary is a fixed $90,000 USD per year, not tied to how many files you clear.
What you bring, and what the CTPRP adds
You will need two to four years in vendor risk, information security, or compliance, plus hands-on time with OneTrust, Prevalent, SecurityScorecard, or BitSight. You should be comfortable reading SOC 2 reports and security questionnaires without a guide. The third-party risk analyst skills that matter most are less glamorous than they sound: careful reading, plain writing, persistent courtesy, and a working sense of common security controls. The CTPRP (Certified Third Party Risk Professional) certification helps but is optional. As a third-party risk analyst certification, it shows you understand the program lifecycle, which helps if your background is general security or audit.
On your third-party risk analyst resume, describe the tiers you handled, the tools you used, and a finding you saw through to closure.
Neighboring desks: vendor risk beside GRC
A GRC analyst usually looks inward: policies, internal controls, audits, risk registers, framework mapping. A third-party risk analyst looks outward at suppliers and spends more time negotiating with people who do not report to them. The skills overlap heavily, and people move between the two. Chasing outside evidence suits some people; shaping your own company's controls suits others.
Getting into vendor risk management
Common routes in are a procurement or contract role that kept bumping into security reviews, an IT audit post, a security operations or compliance analyst seat, or a helpdesk job that grew into access management. If you are looking for third-party risk analyst jobs with no experience, be honest with yourself: this particular role is not one, and genuine entry-level seats in vendor risk are rarer than mid-level ones because the work relies on judgement. A practical path is to volunteer for vendor reviews in your current job, take a third-party risk analyst course or work through CTPRP study material, and read real SOC 2 reports until the structure becomes familiar.
Who keeps vendor files, and where the field is heading
Banks and insurers have long run formal programs because regulators expect them to. SaaS firms do it because their own customers send them questionnaires and want to know about their subprocessors. Healthcare organizations do it because patient data passes through so many suppliers. As organizations rely on more outside software and services, the need for people who can read vendor evidence critically is unlikely to shrink. The work is also shifting towards continuous monitoring and fourth-party questions, which favors analysts who stay curious when every box says "Yes."
