SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 131,000 - 164,000 / annual
Turo, the world's largest car-sharing marketplace, is seeking a Senior Vendor Security Risk Analyst to own and scale the company's third-party risk management (TPRM) program within the Enterprise Security team.
You will manage the complete vendor security lifecycle: intake, risk tiering, due diligence, findings documentation, remediation tracking, and contract renewals. You'll evaluate vendor security evidence including SOC 2 reports, ISO certificates, penetration test results, and security questionnaires, translating complex findings into clear, business-ready risk recommendations. You'll review vendor contracts, Data Processing Agreements (DPAs), and Master Service Agreements (MSAs) from a security perspective and provide approval recommendations before signing.
Key responsibilities include building scalable tiering frameworks and intake workflows that grow with vendor volume, partnering across Procurement, Legal, Privacy, and IT to integrate security review into onboarding and renewal cycles without creating bottlenecks, and maintaining external partnership-facing security questionnaires and trust-center content.
You'll also partner with the Security team to design and deliver security awareness training programs covering phishing, social engineering, third-party risk, and data handling, with role-specific content tailored to different audiences. You'll track training completion and effectiveness, aligning program content with TPRM findings and emerging threats.
Additionally, you'll design and run quarterly user access review campaigns with IT and Security teams, ensuring timely completion, accurate certification decisions, and clear remediation of access exceptions. You'll report on TPRM, training, and access review metrics to security leadership, including cycle time, open findings, remediation aging, and completion rates.
This role operates with significant autonomy and requires strong cross-functional collaboration. The position is hybrid, requiring three days per week in the San Francisco office (Mondays, Wednesdays, Thursdays).
REQUIREMENTS:
- 5+ years in third-party risk management, vendor security, or GRC with direct ownership of vendor security review programs
- Hands-on experience evaluating SOC 2 reports, ISO certificates, and penetration test results; ability to translate findings into business-ready risk recommendations
- Familiarity with contract review from a security perspective (DPAs, MSAs) and comfort working with Legal and Procurement teams
- Working knowledge of cloud security (AWS), IAM, and data-protection principles
- Strong communication skills: ability to distill complex risk findings for non-technical stakeholders at all levels
- Bachelor's degree in Computer Science, Information Security, Information Assurance, or equivalent practical experience
- Relevant security certification: CISA, CISM, CISSP, or equivalent
- Experience with TPRM or GRC tooling (e.g., Vanta, Drata, ZenGRC) and security-automation platforms
- Experience developing or delivering security awareness training, including content creation or phishing simulation
- Background in a regulated or high-trust industry (fintech, marketplace, or SaaS handling sensitive data) is preferred
