Crux Security

Supply Chain Analyst (Vendor & Supply Chain Risk)

Location: Hybrid Remote/On-Site in Austin, TX (Set days in-office weekly required)

Experience Level: Mid to Senior Level

Job Type: Contract / Fractional (Full time)

Certifications: GRC or security certifications (CISA, CRISC, ISO 27001 Lead Implementer/Auditor, CIPP) a bonus

About the Role

Crux Security is looking for a self-directed Supply Chain Analyst to stand up a Supply Chain Risk Management (SCRM) program for a client engagement, working under the direction of an experienced Supply Chain lead who will provide subject-matter direction and quality review. This is a force-multiplier role: you will take a defined scope of work and drive it to audit-ready completion with minimal day-to-day oversight, escalating judgment calls rather than routine execution questions.

You will build a supplier register from scratch, design and apply a vendor risk tiering methodology, review and update security contract clauses alongside Legal, stand up a SOC 2 / ISO 27001 certification review process for critical vendors, and design a SaaS procurement security checklist. The end state is an ISO 27001:2022-aligned evidence package (mapped to A.5.19–A.5.23) that is audit-ready, along with documented procedures and a formal transition plan handing long-term ownership to the client.

What You’ll Do

Vendor Inventory & Supplier Register

• Confirm whether an existing vendor inventory exists outside of IT, and consolidate all available sources into a single, structured supplier register
• Design the register as a spreadsheet-based artifact capturing vendor name, service type, data access, criticality tier, contract status, and review cadence

Vendor Risk Tiering

• Design and apply a vendor risk tiering methodology to the confirmed supplier inventory, prioritizing critical vendors (approximately tens) first
• Build tiering criteria around data sensitivity, operational dependency, and supply chain risk factors, aligned to ISO 27001 controls A.5.19 and A.5.21
• Produce a tiered vendor register as an audit-ready artifact

Security Contract Clauses & Legal Coordination

• Review existing security contract clauses and MSA language for alignment with ISO 27001:2022 requirements
• Update and formalize clause language in active coordination with Legal
• Deliver an updated, audit-ready security contract annex or clause library applicable to new and renewing vendor agreements

Vendor Assurance Review (SOC 2 / ISO 27001)

• Establish a repeatable process for reviewing vendor SOC 2 reports and ISO 27001 certifications as part of ongoing supplier monitoring
• Produce a review methodology, a findings and exceptions log, and completed assessments for all critical vendors within scope

SaaS Procurement Security

• Design a security checklist for evaluating SaaS vendors at the point of procurement, covering data handling, access controls, certifications, incident notification, and exit/portability requirements
• Coordinate with Procurement and Legal throughout checklist design
• Formally introduce security as a touchpoint in the procurement lifecycle, defining where and how reviews occur, who is responsible, and the escalation path for high-risk vendors
• Produce a workflow document that Procurement can operationalize as the long-term owner

ISO 27001:2022 Evidence & Audit Readiness

• Compile all SCRM-related outputs into a structured evidence package mapped to controls A.5.19, A.5.20, A.5.21, A.5.22, and A.5.23
• Ensure traceability between the supplier register, tiering methodology, contract clause library, vendor assessments, and control objectives
• Deliver an audit-ready evidence package

Documentation & Transition Planning

• Document all operational procedures for ongoing SCRM program management, including vendor tiering reviews, contract clause application, SaaS checklist usage, and annual supplier assessment cadence
• Develop a structured handoff plan targeting Procurement as the long-term owner, including ownership mapping, recurring task cadence, recommended FTE profile, and a formal knowledge transfer session

What We’re Looking For

Required

• Demonstrated experience designing or applying a vendor risk tiering methodology
• Experience drafting or revising security contract clauses / annexes, ideally in coordination with Legal
• Experience reviewing SOC 2 reports and ISO 27001 certifications from a vendor risk perspective
• Experience designing procurement-stage security checklists or vendor questionnaires for SaaS
• Comfortable coordinating directly with Procurement and Legal stakeholders
• Experience building supplier inventories or risk registers
• Working knowledge of ISO 27001:2022 evidence requirements and audit expectations
• Able to work independently against a defined scope with minimal supervision, escalating judgment calls rather than routine questions
• Strong written communication; proficiency producing audit-ready documentation with limited rework
• Must pass a background check and comply with client security policies

Strongly Preferred

• Direct experience mapping controls to ISO 27001:2022 Annex A, particularly A.5.19–A.5.23
• Experience developing procedures documentation and FTE transition / handoff plans
• Prior work in a managed services, consulting, or advisory capacity supporting multiple clients
• Familiarity with SOC 2 in addition to ISO 27001

Nice to Have

• GRC or security certifications (CISA, CRISC, ISO 27001 Lead Implementer/Auditor, CIPP) — not required, but appreciated
• Experience with GRC or vendor risk management platforms
• Prior experience with defense industrial base or DoD-adjacent clients
• Exposure to cloud services security considerations

Who You Are

• Execution-focused. You take a scoped deliverable and drive it to completion without needing the work re-explained.
• Low-oversight, high-output. You can operate as a force multiplier under an experienced lead, not a shadow.
• Structured. Registers, methodologies, and evidence packages come out clean and audit-ready the first time.
• Cross-functional. You're comfortable sitting in the same conversation as Legal and Procurement while speaking their language.
• Deadline-driven. You understand what audit-ready by a fixed date actually requires, and work backwards from that objective.

Work Environment

• This is a hybrid, contract / fractional engagement over an initial 3-8 month term, with set in-office days each week. Candidates must be local to Austin, TX or willing to work on-site as required. Occasional client site visits are expected. Extension or conversion to a broader GRC role may be considered based on program needs and performance.