ZipRecruiter

Log In

1

Vendor Risk Analyst Jobs in Frederick, MD (NOW HIRING)

Huntington

Merchant Product Manager - Sr

Hagerstown, MD

$93K - $189K/yr

Product Managers partner closely with stakeholders across Business, Technology, Operations, Risk ... Analysis * Regulatory & Compliance Frameworks * Technology & Digital Product Literacy * Vendor ...

New

FINRA

Lead Buyer

Rockville, MD · Hybrid

$112K - $211K/yr

Collaborate with legal and compliance teams on contract reviews and risk assessments. Analysis ... Highly skilled in negotiation, contract management, and vendor relations. * Proficiency with large ...

Standard Solar

Corporate Counsel

Rockville, MD · On-site

$180K - $200K/yr

Draft, analyze, redline, and negotiate various commercial contracts, including non-disclosure ... vendor agreements, power purchase agreements, leases, EPC agreements and other agreements and ...

Southland Industries

Project Accountant

Dulles, VA · On-site

$60K - $79K/yr

... analyzing and monitoring costs and billings associated with a large construction project as well as ... This position also assures vendor compliance in order to manage project risk. This role is assigned ...

Southland Industries Inc.

Project Accountant

Dulles, VA

$60K - $79K/yr

... analyzing and monitoring costs and billings associated with a large construction project as well as ... This position also assures vendor compliance in order to manage project risk. This role is assigned ...

Capital Bank

CRE Portfolio Manager II

Rockville, MD

$120K - $150K/yr

Analyze and structure the renewal proposals, complete the underwriting and evaluation process to ... Work with outside vendors and professionals to remedy situations as needed. * Perform/create ...

Southland Industries

Senior Project Accountant

Dulles, VA · On-site

$78K - $101K/yr

... analyzing and monitoring costs and billings associated with a large construction project as well as ... This position also assures vendor compliance in order to manage project risk. This role is assigned ...

previous page

Showing results 41-60

All JobsVendor Risk Analyst JobsVendor Risk Analyst Jobs in Frederick, MD

Vendor Risk Analyst information

See Frederick, MD salary details

$15

$40

$65

How much do vendor risk analyst jobs pay per hour?

As of Aug 7, 2026, the average hourly pay for vendor risk analyst in Frederick, MD is $40.25, according to ZipRecruiter salary data. Most workers in this role earn between $29.62 and $48.99 per hour, depending on experience, location, and employer.

What does a vendor risk analyst do?

A vendor risk analyst evaluates the risks associated with third-party vendors to ensure they meet security, compliance, and operational standards. They conduct risk assessments, review vendor controls, and monitor ongoing vendor performance, often using tools like risk management software. Their work helps organizations mitigate potential threats from external partners.

Is risk analyst an entry level job?

A risk analyst role can be entry level or require several years of experience, depending on the organization. Entry-level risk analyst positions typically require a bachelor's degree in finance, economics, or a related field, and may involve basic data analysis skills and familiarity with risk management tools. Advancement often depends on gaining experience and developing specialized skills or certifications such as FRM or CRM.

What is a vendor risk analyst?

A Vendor Risk Analyst is a professional responsible for assessing and managing risks associated with third-party vendors that provide products or services to an organization. They evaluate vendor practices, security protocols, and compliance with regulations to minimize potential risks such as data breaches, financial losses, or operational disruptions. Their work helps organizations ensure that vendors meet required standards and do not pose undue risk to business operations. Vendor Risk Analysts often use questionnaires, audits, and ongoing monitoring to perform their assessments.

How does a vendor risk analyst typically collaborate with other departments within an organization?

Vendor Risk Analysts work closely with various departments such as procurement, legal, IT security, and compliance to assess and manage risks associated with third-party vendors. They facilitate communication between teams to ensure vendor contracts meet security and regulatory requirements. Regularly, they coordinate risk assessments, share findings, and help develop mitigation strategies, ensuring that vendor relationships support the organization's risk tolerance and business goals.

What are the key skills and qualifications needed to thrive as a vendor risk analyst, and why are they important?

To thrive as a Vendor Risk Analyst, you need strong analytical skills, knowledge of risk management frameworks, and a relevant degree in business, finance, or a related field. Familiarity with third-party risk management platforms, regulatory compliance tools, and certifications like Certified Third Party Risk Professional (CTPRP) are often required. Excellent communication, attention to detail, and problem-solving abilities help you effectively assess vendor risks and collaborate with cross-functional teams. These competencies ensure your organization can identify, mitigate, and manage risks associated with external vendors, protecting both operational integrity and regulatory compliance.
What are the most commonly searched types of Vendor Risk Analyst jobs in Frederick, MD? The most popular types of Vendor Risk Analyst jobs in Frederick, MD are:
What are popular job titles related to Vendor Risk Analyst jobs in Frederick, MD? For Vendor Risk Analyst jobs in Frederick, MD, the most frequently searched job titles are:
What job categories do people searching Vendor Risk Analyst jobs in Frederick, MD look for? The top searched job categories for Vendor Risk Analyst jobs in Frederick, MD are:
What cities near Frederick, MD are hiring for Vendor Risk Analyst jobs? Cities near Frederick, MD with the most Vendor Risk Analyst job openings:
Vendor Risk Analyst jobs near you
Infographic showing various Vendor Risk Analyst job openings in Frederick, MD as of August 2026, with employment types broken down into 1% As Needed, 88% Full Time, 8% Part Time, and 3% Contract. Highlights an 88% Physical, 4% Hybrid, and 8% Remote job distribution, with an average salary of $83,727 per year, or $40.3 per hour.

Director of Cyber Threat Intelligence (CTI)

AstraZeneca

Gaithersburg, MD • On-site

Full-time

Medical, Dental, Vision, Retirement, PTO

Re-posted 7 days ago

AstraZeneca rating

8.4

Company rating: 8.4 out of 10

Based on 45 frontline employees who took The Breakroom Quiz

21st of 86 rated pharmaceutical

Job description

About AstraZeneca
AstraZeneca is a global, science-led, patient-focused biopharmaceutical company dedicated to discovering, developing, and commercialising prescription medicines for serious disease. We're committed to being a Great Place to Work.
About the Role
The Director of Cyber Threat Intelligence will lead a highly technical CTI function within AstraZeneca's Cybersecurity Operations division, managing a team of analysts to deliver strategic, operational, and tactical intelligence that measurably reduces risk across the enterprise, including manufacturing, clinical trial platforms, and R&D environments. This role anchors CTI to "intel-to-action" outcomes, partnering closely with Vulnerability Management, Detection Engineering, and Incident Response to harden controls, prioritize patching, improve detections, and accelerate response.
Key Responsibilities
  • Program Leadership and Strategy: Define CTI vision, operating model, and roadmap aligned to AstraZeneca's cyber risk reduction strategy, with special emphasis on manufacturing continuity, clinical data integrity, and R&D IP protection.

  • Adversary Prioritization Framework: Design and operate a scoring rubric that ranks actors based on intent/capability/relevance, TTP emergence and prevalence, organization-specific exposure to known vulnerabilities/CVEs, and global "viral" events, maintaining dynamic watchlists and escalation triggers.

  • MTTI Metric and Analytics: Implement analytic methods to estimate mean time-to-impact per adversary (from initial access to material business impact) using internal telemetry, historical incidents, industry reporting, and confidence levels, performing comparisons with IR's MTTC to drive control improvements.

  • Attack Path Modeling: Build and maintain end-to-end attack path models from initial access to material impact across IT-to-OT pivots, clinical platforms, and R&D environments, mapping steps to MITRE ATT&CK (Enterprise/ICS), identify control gaps and choke points, derive detections-as-code and hunt hypotheses, and support validation efforts including purple-team exercises and adversary emulation to ensure enterprise hardening and measurable risk reduction.

  • Dark Web and Closed-Source Monitoring: Establish collection and monitoring across dark web forums, marketplaces, breach dumps, and closed channels to identify emerging TTPs, credential leaks, data exposure, access-broker listings, and targeting of manufacturing, clinical, or R&D assets, integrating validated findings into TIP/SIEM pipelines, trigger takedown requests where feasible, and deliver rapid advisories with confidence ratings and specific actions for Vulnerability Management, Detection Engineering, and IR.

  • Third-Party and Ecosystem Intelligence: Deliver risk insights for CROs/CMOs/logistics/technology vendors, monitor credential leakage and domain spoofing, and support/coordinate takedown operations when needed.

  • Structured Threat Actor Attribution (Diamond Model): Lead disciplined attribution using the Diamond Model (adversary, capability, infrastructure, victim) and complementary frameworks, correlating TTPs, tooling lineage, code-reuse, infrastructure overlaps, and victimology with confidence levels and analytic caveats, documenting hypotheses, alternative explanations, and disconfirming evidence, and producing reusable actor profiles and pivot paths that inform prioritization, detections, hunts, and incident response playbooks.

  • Support Vulnerability Management: Partner with Vulnerability Management to contextualize CVEs (exploitability, weaponization, external scanning telemetry, compensating controls) and deliver risk-based patching prioritization across AstraZeneca's estate including IT/OT, clinical platforms, and lab environments.

  • Support Detection Engineering: Develop detection use cases to feed our detection-as-code pipeline and support detection ATT&CK coverage mapping, content tuning, and false-positive reduction, ensuring feedback loops from hunts and incidents continuously improve detection quality.

  • Support GSOC/Incident Response: Provide real-time adversary context that is highly technical including kill-chain reconstruction, containment recommendations, and countermeasures, producing post-incident intelligence retrospectives and detection/architecture improvements.

  • Operational and Executive Reporting: Produce daily threat intelligence highlights, threat actor/campaign profiles, quarterly threat briefings, and other ad hoc intelligence products, ensuring products include quantified risk narratives for senior leadership that also align findings to regulatory expectations and business impact.

  • Tooling and Automation: Optimize integrations across TIP, SIEM, EDR, case management, and telemetry; manage indicator lifecycle, automate enrichment, and measure source fidelity/bias.

  • External Engagement: Lead participation with sector bodies (e.g., H-ISAC), peer sharing groups, and government/industry partners; track and assess global events and rapidly translate into actionable enterprise guidance.

  • Team Leadership and Development: Recruit, mentor, and grow a diverse team of CTI analysts; build career paths, training plans, and knowledge-sharing practices; foster a culture of technical excellence and clear, actionable communication.

Minimum Qualifications
  • Leadership and Strategic Impact: 10+ years in cyber threat intelligence, detection engineering, incident response, or related domains; 5+ years leading technical CTI teams in global enterprises. Demonstrated ability to set vision, influence strategy, and deliver outcomes tied to enterprise risk reduction.

  • Decision Making and Accountability: Proven ownership of adversary-centric CTI programs that directly drive vulnerability prioritization, detections-as-code, hunts, and incident response. Comfortable making data-driven decisions with clear trade-offs and confidence levels.

  • Technical Depth (ATT&CK Enterprise/ICS): Deep expertise mapping TTPs to MITRE ATT&CK, defining coverage strategies, and translating gaps into high-fidelity detections and hunt hypotheses; skilled in industrial/OT contexts.

  • Attack Path Modeling and Risk Translation: Hands-on delivery of end-to-end attack paths across IT-to-OT pivots, clinical platforms, and R&D environments; validation via purple-team/adversary emulation; ability to convert findings into prioritized control roadmaps and measurable risk reduction.

  • Adversary Prioritization and Scoring: Designed and operated tailored actor scoring incorporating intent/capability, TTP emergence/prevalence, org exposure to CVEs, and global/viral events; maintained dynamic watchlists and escalation triggers.

  • Structured Attribution Tradecraft: Applied the Diamond Model and complementary frameworks with documented hypotheses, caveats, disconfirming evidence, and confidence statements; produced reusable actor profiles and pivot paths.

  • Metrication (MTTI vs. MTTC): Built mean time-to-impact metrics per actor and operationalized comparisons to IR's mean time-to-containment to guide control improvements and track program effectiveness.

  • Vulnerability Intelligence for Hardening: Delivered contextual CVE analysis (exploitability, weaponization, external scanning telemetry, compensating controls) and risk-based patch recommendations across IT, OT/ICS, clinical, and lab environments.

  • Detection Engineering Collaboration: Co-developed detections-as-code (e.g., Sigma, KQL, SPL), tuned content to reduce false positives, and closed ATT&CK coverage gaps with feedback loops from hunts/incidents.

  • Incident Intelligence Support: Provided real-time adversary context, kill-chain reconstruction, containment recommendations, and post-incident retrospectives that inform detection and architectural improvements.

  • Collection, Tooling, and Automation: Operated dark web/closed-source monitoring; integrated findings into TIP/SIEM/EDR pipelines; managed indicator lifecycle, automated enrichment, and measured source fidelity/bias.

  • Stakeholder Partnership and Communication: Clear, concise communication of complex technical intelligence to executives and cross-functional partners (Vulnerability Management, Detection Engineering, SOC/IR, OT Security, Clinical Ops, Research IT); ability to influence without authority.

  • Education: Bachelor's degree in a relevant field (Computer Science, Information Security, Intelligence Studies, or equivalent experience).

Preferred Qualifications
  • Sector Experience and Regulatory Context: Experience in pharmaceuticals, life sciences, healthcare, or manufacturing; familiarity with GMP/CSV, clinical data obligations, and R&D IP protection.

  • OT/ICS and Critical Operations: Hands-on work with MES, SCADA, PLC ecosystems; ATT&CK for ICS usage; understanding of OT-safe response practices and production continuity implications.

  • Clinical/R&D Platforms: Exposure to CTMS, EDC, IRT, ELN, LIMS, HPC, and data lake environments; experience safeguarding data integrity and sensitive research/IP.

  • Program Metrics and Outcomes: Built dashboards tracking MTTI by actor, ATT&CK coverage indices, intel-informed patch SLAs, hunter ROI, and executive risk narratives; experience presenting to senior leadership and risk committees.

  • Advanced Tooling/Automation: TIP administration, SIEM/EDR content engineering, enrichment/orchestration pipelines, case management integration, and indicator lifecycle automation at enterprise scale.

  • Threat Modeling and Quantification: Ability to translate attack paths into quantified risk scenarios and prioritized control investments aligned to business objectives and crown jewels.

  • External Partnerships: Active engagement with H-ISAC/ISAOs and government/industry partners; track record of rapidly converting global/viral cyber events into enterprise defenses and executive guidance.

  • Certifications: One or more of GCTI, GREM, GRID, GCIH, CISSP, or equivalent demonstrated expertise.

  • People Leadership: Built diverse, high-performing teams; established career paths, coaching frameworks, and a culture of analytic rigor, technical excellence, and continuous improvement.

All roles in IT are expected to demonstrate a mindset of embracing, adopting and appropriately using AI and digital tools in day-to-day work to improve outcomes and ways of working.
Location
  • Gaithersburg, Maryland.

Office Working Requirements
When we put unexpected teams in the same room, we unleash bold thinking with the power to inspire life-changing medicines. In-person working gives us the platform we need to connect, work at pace and challenge perceptions. That's why we work, on average, a minimum of three days per week from the office. But that doesn't mean we're not flexible. We balance the expectation of being in the office while respecting individual flexibility. Join us in our unique and ambitious world.
The annual base pay for this position ranges from $162.536,00 - $243.804,00 USD Our positions offer eligibility for various incentives-an opportunity to receive short-term incentive bonuses, equity-based awards for salaried roles and commissions for sales roles. Benefits offered include qualified retirement programs, paid time off (i.e., vacation, holiday, and leaves), as well as health, dental, and vision coverage in accordance with the terms of the applicable plans.
Date Posted
04-ago-2026
Closing Date
14-ago-2026
Our mission is to build an inclusive environment where equal employment opportunities are available to all applicants and employees. In furtherance of that mission, we welcome and consider applications from all qualified candidates, regardless of their protected characteristics. If you have a disability or special need that requires accommodation, please complete the corresponding section in the application form.

What AstraZeneca employees say

Pay

Benefits

Hours and flexibility

Workplace

Get the full story on Breakroom

Apply