Third-Party Risk Analyst

Join Clio, a leading legal technology company, as a Third-Party Risk Analyst. In this role, you will be responsible for ensuring that external vendors meet Clio's security and privacy standards before accessing Clio or customer data. You will review vendor security documentation, evaluate integration submissions, triage for privacy review, and escalate risks for acceptance. You will also maintain the third-party risk registry and support renewals and reassessments. This position offers a hybrid work model, equitable compensation, and various benefits.

• Review vendor security documentation submitted through the intake process, including SOC 2 reports, penetration test summaries, security whitepapers, AI disclosures, and questionnaire responses, and determine whether the vendor meets Clio's required level of security and privacy.
• Triage for privacy review by identifying when a vendor or integration will process confidential or sensitive data and route it into a Data Privacy Impact Assessment (DPIA), partnering with Privacy/Compliance.
• Move reviews through the workflow by tracking submissions, requesting missing artifacts from requesters and vendors, responding to comments, and handing off cleanly to IT, Legal, and executive sign-off.

• Strong organizational skills. You keep multiple reviews moving without losing track of what's waiting on whom
• Understanding of core security and privacy concepts, including access controls, encryption, data classification, data residency, and what different tiers of security and privacy documentation look like
• 2–4 years of hands-on experience in a security, compliance, GRC, vendor risk, or procurement review role
• Working familiarity with third-party audit artifacts. You've read SOC 2 reports and know how to review them and extract a deeper understanding
• Comfort working within an established review process and contributing to its improvement
• Clear, evidence-first written communication
• Demonstrated ability to review documentation critically and separate real risk from noise
• Knows when to figure something out independently and when to pull in a subject matter expert
• You take full ownership of your review queue, communicate effectively, and are able to balance competing priorities
• You have an intuition for looking beyond the presented facts and noticing emerging patterns across artifacts
• You're curious about why a control matters, not just whether a box is checked
• Your curiosity drives you to learn the why behind the answers, questions, and processes
• You have the judgment to hold the line on a real risk and the pragmatism to keep low-risk reviews moving
• You communicate clearly when documentation is missing, when a risk needs escalation, or when you need help. Nothing gets quietly approved
• You're energized by helping build and sharpen a review function rather than inheriting a finished one
• Previous experience with GRC, TPRM, or vendor management tooling
• You are able to see the gaps in documentation and suggest compensating controls where applicable
• Exposure to SOC 2, ISO 27001, PCI DSS, or GDPR/CCPA concepts in an audit context
• Experience with GDPR, CCPA, DPIAs and/or privacy impact assessments
• CISA, CIPP/CIPM, CTPRP, CompTIA Security+, or equivalent certification