ZipRecruiter

Log In

1

Vendor Risk Management Analyst Jobs in Washington, DC

Ibility

Risk Management Analyst

Washington, DC · Remote

The Risk Management Analyst supports the identification, assessment, and communication of discrete and overall program and project risk across cost, schedule, and performance dimensions within a ...

Ibility

Risk Management Analyst

Washington, DC

The Risk Management Analyst supports the identification, assessment, and communication of discrete and overall program and project risk across cost, schedule, and performance dimensions within a ...

Ibility

Risk Management Analyst

Washington, DC · On-site +1

The Risk Management Analyst supports the identification, assessment, and communication of discrete and overall program and project risk across cost, schedule, and performance dimensions within a ...

IMR Soft Llc

Risk Manager

Mclean, VA · On-site

$55 - $60/hr

Perform risk tracking, trending, analysis, and executive reporting * Provide strategic thinking on next levels of maturity in Technology & Vendor Risk management * Act as a cross functional partner ...

next page

Showing results 1-20

All JobsVendor Risk Management Analyst JobsVendor Risk Management Analyst Jobs in Washington, DC

Vendor Risk Management Analyst information

See Washington, DC salary details

$41.3K

$93.2K

$156.3K

How much do vendor risk management analyst jobs pay per year?

As of Aug 5, 2026, the average yearly pay for vendor risk management analyst in Washington, DC is $93,246.00, according to ZipRecruiter salary data. Most workers in this role earn between $70,800.00 and $102,500.00 per year, depending on experience, location, and employer.

What is a vendor risk management analyst?

A Vendor Risk Management Analyst is a professional responsible for assessing, monitoring, and mitigating risks associated with third-party vendors and suppliers. They evaluate vendor practices, ensure compliance with company policies and regulations, and help protect the organization from financial, operational, and reputational risks. Their work often involves conducting risk assessments, reviewing contracts, and collaborating with other departments to ensure vendors meet required security and performance standards.

What are the key skills and qualifications needed to thrive as a vendor risk management analyst, and why are they important?

To thrive as a Vendor Risk Management Analyst, you need expertise in risk assessment, third-party due diligence, and a solid understanding of compliance regulations, typically supported by a bachelor’s degree in business, finance, or a related field. Proficiency with risk management software, vendor management platforms, and knowledge of frameworks like ISO 27001 or SOC 2 are commonly required, along with certifications such as CTPRP or CISA. Strong analytical thinking, attention to detail, and effective communication skills are essential for building relationships and reporting risks clearly. These skills ensure organizations can identify, mitigate, and manage risks associated with third-party vendors, protecting operational integrity and regulatory compliance.

How does a vendor risk management analyst typically interact with other departments within an organization?

Vendor Risk Management Analysts often collaborate closely with departments such as Procurement, Legal, IT Security, and Compliance to assess and mitigate risks associated with third-party vendors. They facilitate information sharing, coordinate risk assessments, and ensure that contract terms align with the organization's risk tolerance. Regular communication and cross-functional meetings are common, as these analysts play a key role in ensuring that vendor relationships do not expose the organization to undue risk.

What is the difference between Vendor Risk Management Analyst vs Procurement Analyst?

AspectVendor Risk Management AnalystProcurement Analyst
CertificationsCertifications like CTPRP, CRISC, or vendor risk management coursesCPM, CPSM, or purchasing certifications
Work EnvironmentFocus on risk assessment, compliance, and vendor evaluationsFocus on sourcing, purchasing, and supplier negotiations
Industry UsageCommon in finance, healthcare, and technology sectorsPrevalent across manufacturing, retail, and corporate sectors

The main difference is that a Vendor Risk Management Analyst specializes in assessing and mitigating risks associated with vendors, ensuring compliance and security. In contrast, a Procurement Analyst primarily handles sourcing and purchasing activities. Both roles require analytical skills and industry knowledge but focus on different aspects of vendor and supply chain management.

What are popular job titles related to Vendor Risk Management Analyst jobs in Washington, DC? For Vendor Risk Management Analyst jobs in Washington, DC, the most frequently searched job titles are:
What job categories do people searching Vendor Risk Management Analyst jobs in Washington, DC look for? The top searched job categories for Vendor Risk Management Analyst jobs in Washington, DC are:
Vendor Risk Management Analyst jobs near you
Infographic showing various Vendor Risk Management Analyst job openings in Washington, DC as of July 2026, with employment types broken down into 85% Full Time, 8% Part Time, and 7% Contract. Highlights an 85% In-person, and 15% Remote job distribution, with an average salary of $93,246 per year, or $44.8 per hour.

Supply Chain Risk Management Senior Analyst

Leidos

Washington, DC

Full-time

Posted 6 days ago

Leidos rating

8.3

Company rating: 8.3 out of 10

Based on 151 frontline employees who took The Breakroom Quiz

75th of 481 rated business services

Job description

Leidos is seeking a Senior-Level Supply Chain Risk Management Analyst to provide advanced technical and analytical support to the FAA's Counterintelligence (CI) Supply Chain Risk Management (SCRM) program. The program is responsible for identifying, assessing, and mitigating foreign intelligence, nation-state, and cybersecurity threats to the FAA's supply chain, critical infrastructure, and enterprise networks. Embedded as a senior leader within a 3-person team, this position focuses on complex enterprise risk assessments and procurement execution support. Providing high-level, independent analytical support aligned with the FAA Acquisition Management System (AMS) framework, the senior analyst evaluates the actual security posture of software suppliers, cloud providers, Artificial Intelligence (AI) tools, telecommunications, and Operational Technology / Industrial Control Systems (OT/ICS) environments. This role translates threat data into technical risk scoring, conducts complex criticality analyses, and drafts custom contract security language to protect and mitigate advanced threats against the FAA supply chain.

Primary Responsibilities:

  • Team lead ensuring strict quality control, mentoring, and analytical integrity across all FAA CI SCRM products.
  • Lead the execution of complex, enterprise-level vendor risk assessments and oversee the analytical triage of Software Bills of Materials (SBOMs) for critical air traffic management software, cloud providers (SaaS/PaaS/IaaS), Artificial Intelligence (AI) tools, telecommunications, and Operational Technology / Industrial Control Systems (OT/ICS) frameworks.
  • Conduct and oversee technical and non-technical risk scoring methodologies to compile comprehensive Vendor Risk Reports that map systemic vulnerabilities and cascading supply chain risks.
  • Provide authoritative SCRM analytical expertise throughout the procurement lifecycle, guiding early-stage acquisition planning and complex source selections.
  • Author definitive Acquisition Security Reviews and evaluation matrices that support and align with the FAA AMS pipeline.
  • Formulate and draft specific contract security language, technical security requirements, and risk acceptance recommendations to legally bind vendors and mitigate identified supply chain risks prior to contract award.
  • Translate highly technical, complex risk assessment data into clear, sophisticated Executive Decision Packages and dashboards tailored for a non-technical audience to enable FAA senior leadership to make rapid, fully informed decisions.
  • Lead the development, refinement, and maintenance of FAA SCRM policies, governance documentation, and standard operating procedures (SOPs).
  • Formulate strategic performance metrics and high-level program reports to track enterprise SCRM compliance for executive leadership.
  • Maintain critical operational and collaborative relationships with external stakeholders, including the FAA Chief Information Officer (CIO), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Homeland Security (DHS), and the broader Intelligence Community (IC).
  • Create, coordinate, and facilitate comprehensive SCRM training and awareness campaigns for acquisition personnel and program offices agency wide.

Basic Qualifications:

  • Citizenship: U.S. Citizenship required.
  • Clearance: Active Top Secret/SCI clearance is required.
  • Education: Bachelor's or Master's degree in Supply Chain, Intelligence Studies, National Security, Logistics, Data Science, Cybersecurity, Information Technology, Computer Science, Computer Engineering, or a related technical discipline. (Equivalent professional experience or specialized military/federal training may be substituted).
  • Experience: 12+ years of professional experience as an Intelligence Analyst (All-Source, Cyber, Counterintelligence, or Open-Source Intelligence) or senior-level experience in third-party risk management (TPRM), Cyber Supply Chain Risk Management (C-SCRM), technical risk assessments, IT auditing, cybersecurity risk management, or infrastructure defense in a federal or highly regulated commercial environment.
  • Framework Knowledge: Strong working knowledge of federal cybersecurity and risk management frameworks, specifically NIST SP 800-161 (Cybersecurity Supply Chain Risk Management Practices) and NIST SP 800-53.
  • Technical Skills: Demonstrated hands-on experience evaluating the security posture, software supply chains, and configurations of at least three of the following technology profiles:
    • Cloud infrastructure and service providers (SaaS, PaaS, IaaS)
    • Commercial software packages and open-source dependencies
    • Artificial Intelligence (AI) platforms or Machine Learning tools
    • Telecommunications hardware or infrastructure frameworks
    • Operational Technology (OT) or Industrial Control Systems (ICS)
  • Communication Skills: Proven capability to translate complex technical vulnerabilities, software flaws, and architectural risks into clear, well-structured, non-technical written reports and executive summaries.

Preferred Qualifications:

  • Completion of formal military or federal intelligence training courses focusing on threat network analysis or open-source collection.
  • Possession of one or more of the following industry-recognized certifications:
    • Certified Information Systems Security Professional (CISSP)
    • Certified in Risk and Information Systems Control (CRISC)
    • Certified Information Systems Auditor (CISA)
    • Specialized federal SCRM or Counterintelligence training certifications (e.g., CDSE, ODNI, or defense-sponsored SCRM courses).
  • Direct, demonstrable experience reviewing federal procurement mechanisms, source selection processes, or drafting legally binding contract security language specifically tailored to the FAA AMS framework.
  • Ability to align supply chain threat assessments with the 5-step FAA Safety Risk Management (SRM) process (System Analysis, Hazard Identification, Risk Analysis, Risk Assessment, and Mitigation Control).
  • Expert knowledge of Intelligence Community Directives (ICD 203) and Structured Analytic Techniques

If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 - and moving faster than anyone else dares.

Original Posting:July 30, 2026

For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.

Pay Range:Pay Range $116,350.00 - $210,325.00

The Leidos pay range for this job level is a general guideline onlyand not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.

What Leidos employees say

Pay

Benefits

Hours and flexibility

Workplace

Get the full story on Breakroom

Leidos logo

About Leidos

Sourced by ZipRecruiter

At Leidos, we deliver innovative solutions through the efforts of our diverse and talented people who are dedicated to our customers' success. We empower our teams, contribute to our communities, and operate sustainable practices. Everything we do is built on a commitment to do the right thing for our customers, our people, and our community.

Industry

It services

Company size

10,000+ Employees

Headquarters location

Reston, VA, US

Social media

FacebookTwitter

View All Leidos Jobs

Apply