ZipRecruiter

Log In

1

Vendor Risk Assessment Jobs in Virginia (NOW HIRING)

Alera Group

Risk Analyst

Richmond, VA · On-site +1

$87K - $110K/yr

Perform third-party security and compliance risk assessments for new and existing vendors, evaluating risk exposure, control effectiveness, business impact, and remediation requirements * Review SOC ...

Resourcesoft, Inc.

Infosec Risk Management

Reston, VA · On-site

Proficiency in Third-Party Risk Management (TPRM) and vendor security evaluations. * Experience with cloud security assessments across AWS implementations, SaaS applications, and AI platforms.

New

System One

Third Party Risk Manager

Vienna, VA · On-site

Ideal candidate: strong experience in third-party risk, vendor governance, and risk assessment operations System One, and its subsidiaries including Joulé and Mountain Ltd., are leaders in ...

Socket.dev

Senior IT Security Engineer

Chesapeake, VA · On-site

$125 - $150/hr

Lead third-party vendor security risk management, directing vendor risk assessments, critical vendor classification, and ongoing monitoring of vendor compliance obligations. * Direct the security ...

NextgenID

GRC Lead

Fairfax, VA · On-site

$95 - $120/hr

Own third-party and vendor risk assessments across our tooling and supply chain. * Own the security-questionnaire program (final review and sign-off) and represent our posture to customers and ...

INIT MENA

Senior IT Security Engineer

Chesapeake, VA · On-site

$92K - $126K/yr

... risk assessments, critical vendor classification, and ongoing monitoring of vendor compliance obligations. • Direct the security awareness and training program, setting curriculum priorities ...

INIT MENA

Senior IT Security Engineer

Chesapeake, VA · On-site

$92K - $126K/yr

... risk assessments, critical vendor classification, and ongoing monitoring of vendor compliance obligations. • Direct the security awareness and training program, setting curriculum priorities ...

NextgenID

GRC Analyst

Fairfax, VA · On-site

$75 - $95/hr

Support third‑party and vendor risk assessments and evidence requests. * Route completed responses to the GRC Lead and management for review before submission. Research & Program Support -- support ...

Freddie Mac

IT Risk Technical Lead

Mclean, VA · On-site

Lead and support operational control testing activities to assess control execution effectiveness * Coordinate and manage third-party vendor risk governance activities, including vendor SOC and ...

previous pagenext page

Showing results 21-40

All JobsVendor Risk Assessment JobsVendor Risk Assessment Jobs in Virginia

Vendor Risk Assessment information

What is a vendor risk assessment?

A Vendor Risk Assessment is a process used by organizations to evaluate and manage the potential risks associated with outsourcing services or products to third-party vendors. The assessment typically examines areas such as data security, regulatory compliance, financial stability, and operational practices of the vendor. Its purpose is to identify potential vulnerabilities or threats that could impact the organization if the vendor fails to meet expectations or is compromised. Regular vendor risk assessments help ensure that third-party relationships do not expose the company to undue risk and that appropriate controls are in place.

What are the key skills and qualifications needed to thrive as a vendor risk assessment professional?

To thrive in Vendor Risk Assessment, you need a solid understanding of risk management principles, third-party due diligence, and regulatory compliance, often supported by a degree in business, IT, or a related field. Familiarity with risk assessment tools, governance frameworks (like ISO 27001), and platforms such as GRC (Governance, Risk, and Compliance) systems is typically required. Strong analytical thinking, attention to detail, and effective communication skills help professionals assess vendor risks and collaborate across departments. These skills are crucial for identifying, mitigating, and communicating risks that could impact an organization’s operations, security, or reputation.

What are some common challenges faced in a vendor risk assessment role, and how can I prepare to address them?

Professionals in Vendor Risk Assessment often encounter challenges such as managing large volumes of vendor data, ensuring compliance with evolving regulations, and effectively communicating risks to both internal stakeholders and vendors. To prepare for these challenges, it's important to develop strong organizational and analytical skills, stay informed about regulatory changes, and build effective communication strategies. Collaborating closely with procurement, legal, and IT teams is also essential for gathering accurate information and implementing risk mitigation measures.

What is the difference between Vendor Risk Assessment vs Vendor Compliance Analyst?

AspectVendor Risk AssessmentVendor Compliance Analyst
Primary FocusEvaluating risks associated with vendors and third-party providersEnsuring vendors comply with policies, regulations, and contractual obligations
CertificationsCertifications like CISSP, CISA, or vendor risk management coursesCertifications such as CCEP, CISA, or compliance-specific credentials
Work EnvironmentRisk management teams, procurement, cybersecurity departmentsCompliance teams, legal, procurement, and audit departments
Industry UsageCommon in finance, healthcare, and IT sectorsPrevalent in regulated industries like finance, healthcare, and manufacturing

Vendor Risk Assessment focuses on identifying and mitigating risks posed by vendors, while Vendor Compliance Analysts ensure vendors adhere to policies and regulations. Both roles are essential for managing third-party relationships but differ in their primary objectives and activities.

What cities in Virginia are hiring for Vendor Risk Assessment jobs?

Cities in Virginia with the most Vendor Risk Assessment job openings:

Vendor Risk Assessment jobs near you
Infographic showing various Vendor Risk Assessment job openings in Virginia as of August 2026, with employment types broken down into 1% As Needed, 86% Full Time, 10% Part Time, and 3% Contract. Highlights an 87% Physical, 4% Hybrid, and 9% Remote job distribution.

Risk Analyst

Alera Group

Richmond, VA • On-site, Remote

$87K - $110K/yr

Full-time

Medical, Dental, Vision, Life, Retirement, PTO

This job post has expired 2 days ago. Applications are no longer accepted.

Key responsibilities

  • Perform third-party security and compliance risk assessments for new and existing vendors.

  • Review SOC reports, security questionnaires, audit documentation, and certifications to identify control gaps and potential business impacts.

  • Coordinate and execute user access reviews, validating access appropriateness and ensuring issues are remediated promptly.

Alera Group rating

7.5

Company rating: 7.5 out of 10

Based on 31 frontline employees who took The Breakroom Quiz

226th of 315 rated insurance

Job description

OVERVIEW
Risk Analyst

Location: Deerfield, IL | Remote
Department: Corporate Services

Overview

At Alera Group, our corporate teams play a critical role in supporting the success of colleagues and clients across the country. From Human Resources and Finance to Technology, Legal, Marketing, and Operations, these professionals ensure our organization runs efficiently while enabling our teams to deliver exceptional service.

About Alera Group

Founded in 2017, Alera Group has grown to become the 14th largest broker of U.S. business. We are passionate about our clients’ success in Employee Benefits, Property & Casualty Insurance, and Financial Services. With offices nationwide, our collaborative approach allows us to deliver national strength with local service.

We are always looking to connect with talented professionals who want to contribute to a collaborative, high-growth environment and help drive strategic initiatives across a national organization.

Why Join Alera Group?
  • Collaborate with purpose – Work alongside colleagues who believe the best results come from strong partnerships, shared expertise, and supporting one another.
  • Build your career – Expand your expertise through meaningful work, continuous learning, and opportunities to grow across a national organization.
  • Make an impact – Help clients navigate complex challenges while contributing to solutions that make a difference for their businesses, employees, and communities.

RESPONSIBILITIES
  • Perform third-party security and compliance risk assessments for new and existing vendors, evaluating risk exposure, control effectiveness, business impact, and remediation requirements
  • Review SOC reports, security questionnaires, audit documentation, certifications, and other evidence to identify control gaps and potential business impacts
  • Coordinate and execute user access reviews, validating access appropriateness and ensuring identified issues are remediated promptly
  • Document risks, findings, recommendations, and remediation plans while maintaining accurate records within governance, risk, and compliance platforms
  • Serve as a trusted advisor to stakeholders by asking thoughtful questions, identifying underlying business needs, assessing potential risks, and translating ambiguous requests into clear risk assessment, governance, and compliance activities
  • Partner with Information Security, Technology, Legal, Procurement, and business stakeholders to identify requirements, resolve risk and compliance issues, and drive effective risk-based decision-making
  • Support internal and external audits, regulatory examinations, and compliance activities through evidence collection and documentation management
  • Develop risk metrics, reporting, and dashboards that drive visibility, support decision-making, and measure the effectiveness of third-party risk and governance programs
  • Identify opportunities to improve risk management processes, controls, reporting, governance practices, and automation capabilities

QUALIFICATIONS

Required Qualifications

  • 5+ years of experience in cybersecurity risk, IT risk, information security, governance, risk and compliance (GRC), third-party risk, IT audit, or a related field
  • Hands-on experience performing third-party or vendor security risk assessments
  • Experience coordinating or performing user access reviews, access certifications, or identity governance activities
  • Familiarity with cybersecurity and compliance frameworks such as NIST CSF, SOC 2, CIS Controls, HIPAA, or similar standards
  • Strong analytical, critical thinking, and communication skills with the ability to evaluate complex situations, identify underlying business and risk requirements, and effectively communicate recommendations to both technical and non-technical audiences
  • Experience working with GRC, ticketing, identity governance, or third-party risk management platforms
  • Exercise sound judgment when evaluating risk scenarios, identifying gaps in information, and determining appropriate next steps, stakeholders, and remediation activities
Certifications
  • CISA, CGRC or equivalent preferred
Preferred Qualifications
  • Experience within a regulated industry such as insurance, financial services, or healthcare
  • Experience supporting SOC 2, HIPAA, NYDFS, or similar regulatory and compliance programs
  • Experience with automated identity governance, access certification, or third-party risk management solutions
  • Experience supporting internal or external security and compliance audits
  • Ability to independently research requirements, develop risk-based recommendations, and communicate findings to stakeholders
  • Demonstrated ability to gather and clarify ambiguous requirements, ask effective probing questions, and develop practical risk-based solutions in collaboration with business stakeholders
Compensation
  • Salary Range: $87,000 - $110,000 annually
  • Bonus Eligible: Yes
Benefits

Eligible colleagues enjoy a comprehensive benefits package including:

  • Medical, dental, and vision insurance
  • Life and disability coverage
  • 401(k)
  • Generous paid time off
  • Professional development and career growth opportunities

ADDITIONAL INFORMATION

Work Model:
This role is Remote
Preference for Central or Eastern Time Zone

Professional Development – Alera Group Academy

At Alera Group, growth isn’t left to chance. Through Alera Group Academy, we provide structured development opportunities designed to help you expand your expertise and build a meaningful career.

You’ll have access to:

  • Role-specific learning paths

  • Leadership development programs

  • Technical and compliance training

  • Industry certifications and continuing education support

  • Peer learning and knowledge-sharing communities

Whether you’re deepening technical expertise or preparing for leadership, we’re invested in helping you grow.

We're an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran or disability status, or any other protected class.

Alera Group is committed to protecting your privacy. Please review our Privacy Policy to understand what personal information we may collect and use as part of your application process.

#LI-NO1

#LI-Remote 


Location Type
Hybrid - 2 or less days in officeQualifications:

Required Qualifications

  • 5+ years of experience in cybersecurity risk, IT risk, information security, governance, risk and compliance (GRC), third-party risk, IT audit, or a related field
  • Hands-on experience performing third-party or vendor security risk assessments
  • Experience coordinating or performing user access reviews, access certifications, or identity governance activities
  • Familiarity with cybersecurity and compliance frameworks such as NIST CSF, SOC 2, CIS Controls, HIPAA, or similar standards
  • Strong analytical, critical thinking, and communication skills with the ability to evaluate complex situations, identify underlying business and risk requirements, and effectively communicate recommendations to both technical and non-technical audiences
  • Experience working with GRC, ticketing, identity governance, or third-party risk management platforms
  • Exercise sound judgment when evaluating risk scenarios, identifying gaps in information, and determining appropriate next steps, stakeholders, and remediation activities
Certifications
  • CISA, CGRC or equivalent preferred
Preferred Qualifications
  • Experience within a regulated industry such as insurance, financial services, or healthcare
  • Experience supporting SOC 2, HIPAA, NYDFS, or similar regulatory and compliance programs
  • Experience with automated identity governance, access certification, or third-party risk management solutions
  • Experience supporting internal or external security and compliance audits
  • Ability to independently research requirements, develop risk-based recommendations, and communicate findings to stakeholders
  • Demonstrated ability to gather and clarify ambiguous requirements, ask effective probing questions, and develop practical risk-based solutions in collaboration with business stakeholders
Compensation
  • Salary Range: $87,000 - $110,000 annually
  • Bonus Eligible: Yes
Benefits

Eligible colleagues enjoy a comprehensive benefits package including:

  • Medical, dental, and vision insurance
  • Life and disability coverage
  • 401(k)
  • Generous paid time off
  • Professional development and career growth opportunities
Education:UNAVAILABLEEmployment Type: FULL_TIME

What Alera Group employees say

Pay

Benefits

Hours and flexibility

Workplace

Get the full story on Breakroom

Apply