TPRM Auditor

About the Company: 

VISO TRUST is the only SaaS third party cyber risk management platform that delivers the security intelligence needed for modern companies to make critical risk decisions at the speed of business.  Assessing the risk of data breach third party relationships pose to their customers is a traditionally complex and labor intensive process that slows business, frustrates stakeholders and leaves security teams branded: the department of “no.”  With VISO’s AI-based system, practitioners can instantly and continually assess any number of third parties while achieving on average a 90% boost in operational efficiency.  At VISO, we are excited to be enabling customers to reduce risk and accelerate business at the same time.

VISO TRUST is a venture-backed startup with a fully remote workforce based in North America.  When hiring, we look for signs that a candidate will thrive in our culture, where we put people first and value ownership, curiosity, honesty and humility in the pursuit of excellence.  We also value our differences, employing a team rich in diverse perspectives and experiences.  We are dedicated to equal employment opportunities regardless of status or membership in a protected class or lack thereof.

About the Job

As a Third Party Risk Auditor at VISO TRUST, you will be responsible for analyzing security documents, conducting third-party risk assessments, and ensuring the accuracy of our AI-driven platform’s automated due diligence. You’ll collaborate with Product, Engineering, and Machine Learning teams to improve risk assessments and enhance platform efficiency. This role is ideal for someone with strong analytical skills and experience in cybersecurity frameworks, excited to work with AI to streamline third-party risk management.

Key Responsibilities

• Analyzing security program related language and documents, recording text annotations for the training of machine learning models and ensuring quality assurance on the conclusions drawn by automated assessments
• Conducting domestic and global third party risk assessments including coordinating intake of new third parties and new engagements, third party security reviews, interacting with internal and external stakeholders, reporting on assessment outcomes and tracking remediation efforts
• Working closely with Product, Engineering, Customer Success and Machine Learning teams to contribute to automation logic and model training and ensure the success of reviews performed on the platform
• Apply VISO TRUST methodology to to evaluate control presence and determine risk
• Document assessment procedures for subsequent automation 
• Review business and technical assessments, questionnaires and related documentation 
• Schedule and conduct review calls with third parties: ensure and track questionnaires sent to third parties, track and report on abandoned third parties, receive and review questionnaires responses and finalize reports 
• Coordinate other due diligence that needs to be done in addition to security questionnaire when needed 
• Collaborate with VISO Audit, Product, Engineering and Machine Learning personnel to develop continued program process and platform improvements 
• Report on assessment outcomes, risk levels, and remediation progress

Key Skills, Qualifications & Experience

• Strong analytical/critical thinking skills 
• Excellent written, verbal communication and organizational skills 
• Ability to perform policy and standard gap analyses based on leading security frameworks 
• Knowledge of common control and policy taxonomies and hierarchies and related language 
• Knowledge of common third party assurance related documents, their structure and analysis, such as AICPA SOC reports, PCI DSS ROC, HiTrust, ISO 27001 Statements of Applicability, etc.
• Deep knowledge and experience with regard to the VISO TRUST technology platform and it’s unique approach to text extraction and automated risk determination
• Bachelor’s degree with a major in Information Security or equivalent combination of education and experience, ie. CISSP, CISA, CIPP, CRISC, CEH, and/or CISM 
• 1-4 years of experience with third party cyber risk management 
• Have performed IT risk assessments against OWASP, PCI, GLBA, NIST, ISO, SIG/AUP or other standards 
• Strong knowledge base in information security, risk management, privacy, operations, enterprise networking, systems evaluation, and architecture 
• Ability to discern business relevant risk associated with technology control deficiencies, and to identify the corresponding remediation which is required to mitigate the business impact 
• Knowledge of security, risk and privacy regulatory frameworks such as NIST, SOX, PCI, HIPAA, ISO, Safe Harbor, CSA, etc. 
• Self-starter who can function independently with limited direction but work closely with others when necessary.
• Knowledge of security, risk and privacy regulatory frameworks such as NIST, SOX, PCI, HIPAA, ISO, Safe Harbor, CSA, etc. 
• Self-starter who can function independently with limited direction but work closely with others when necessary