{"id":4040166,"url":"https://alion.io/job/xai-sr-security-analyst-third-party-risk-management","title":"Sr. Security Analyst, Third Party Risk Management","company":{"id":28,"name":"xAI","domain":"x.ai","url":"https://alion.io/company/xai","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":82,"open_postings":87,"ghost_share":0,"stale_share":0.517,"repost_share":0,"time_to_fill_p50_days":68,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Austin, United States","New York, United States","Palo Alto, United States","Washington, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":228000,"max":null,"currency":"USD","period":"year","gross":null,"usd_annual":228000},"salary_estimate":null,"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"EU AI Act","optional":false},{"name":"Grok","optional":false},{"name":"ISO 27001","optional":false},{"name":"ISO 42001","optional":false},{"name":"LLM","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"NIST CSF","optional":false},{"name":"SOC 2","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"FedRAMP","optional":true},{"name":"GCP","optional":true},{"name":"GDPR","optional":true},{"name":"HIPAA","optional":true},{"name":"NIST 800-171","optional":true},{"name":"PCI DSS","optional":true},{"name":"ServiceNow","optional":true}],"status":"live","first_seen_at":"2026-11-10T20:15:42Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-13T16:11:48Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars.\nSpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next.\nSR. SECURITY ANALYST, THIRD PARTY RISK MANAGEMENT\nWe are seeking a mid-to-senior Governance, Risk, and Compliance (GRC) professional focused on third-party risk management (TPRM) to own and scale our vendor risk program as SpaceXSI grows. This role sits at the intersection of cybersecurity GRC, vendor management, and procurement: you will assess the full range of third parties the company depends on - software and SaaS providers, cloud and infrastructure partners, AI model and data providers, professional services firms, and other suppliers - from intake and due diligence through ongoing monitoring and offboarding. The ideal candidate brings a cybersecurity and GRC perspective - fluent in how cloud services, identity and access management, encryption, data flows, and AI/LLM systems actually work in production - and can translate assessment findings into clear, risk-based decisions on residual risk and compensating controls rather than simply documenting issues. You will collaborate across procurement, legal, security, privacy, engineering, and business owners to keep third-party risk clear, proportionate, and actionable across enterprise, commercial, and public-sector environments.\nRESPONSIBILITIES:\nOwn the end-to-end third-party risk lifecycle - intake, inherent risk tiering, due diligence, risk decisioning, contracting support, ongoing monitoring, and offboarding - for vendors and partners across the company\nDesign and maintain the risk-tiering methodology and inherent risk questionnaire based on data sensitivity, system and network access, business criticality, and regulatory exposure, so that assessment depth matches actual risk and lower-risk vendors move quickly\nConduct security, privacy, and business due diligence: issue and review security questionnaires (e.g., SIG, CAIQ, custom assessments), evaluate architecture diagrams and data flows, run follow-up sessions with vendor security teams, and coordinate business checks such as corporate registration, reputational review, and insurance coverage with cross-functional partners\nCritically review independent assurance reports and security documentation, including SOC 1/SOC 2 Type II reports, ISO 27001 and ISO 42001 certificates and Statements of Applicability, penetration test and vulnerability summaries, and bridge letters. Evaluate scope, carve-outs, exceptions, and complementary user entity controls (CUECs) that SpaceXSI must operate\nTranslate findings into clear risk decisions: weigh residual risk and compensating controls, recommend approval, conditional approval, or rejection, and document risk exceptions and risk acceptances with clear rationale, owners, and expiration dates\nPartner with Legal and Procurement to define and negotiate contract security terms, including security and data protection exhibits, DPAs, breach notification, right-to-audit, sub-processor clauses, and data retention and deletion requirements, and ensure SpaceXSI's compliance obligations flow down to vendors and sub-processors\nAssess the risk of AI vendors and AI-enabled services, including model and data handling, training-data use and boundaries, prompt and output controls, data residency, and alignment with AI governance frameworks (e.g., NIST AI RMF, ISO 42001, EU AI Act)\nOversee fourth parties and sub-processors: map critical downstream dependencies, track sub-processor changes, and assess concentration, business continuity, and supply-chain risk for critical vendors\nRun continuous monitoring of the vendor population using security ratings, breach and threat intelligence, certification expirations, and tier-based reassessment cadences, and lead third-party response when a vendor has a security incident\nMaintain the third-party risk register and track issues, findings, and remediation plans with vendors and internal owners through to closure, with defined SLAs and escalation paths\nOperate and extend GRC platforms (e.g., Vanta) as the system of record for vendor inventory, assessments, and evidence; use automation, scripting, low-code, and AI-assisted workflows to streamline intake, tiering, questionnaire review, evidence collection, and reassessment\nDevelop and maintain TPRM policies, standards, procedures, and runbooks that align with SpaceXSI's control environment and frameworks such as SOC 2, ISO 27001, ISO 42001, and NIST CSF / SP 800-53, and support internal and external audits with third-party evidence\nCreate and present concise reporting on vendor risk posture, program health, open findings, high-risk vendors, and emerging third-party risk themes to GRC, Security, and business leadership, and guide business owners on TPRM requirements and expectations\nBASIC QUALIFICATIONS:\nBachelor's degree in computer science, information security, cybersecurity, or in an engineering/STEM discipline\n5+ years of experience in third-party risk management, vendor security, cybersecurity GRC, IT audit, or a role in security, with hands-on responsibility for performing assessments rather than only administering a program\nPREFERRED SKILLS AND EXPERIENCE:\n7+ years of third-party risk, vendor security, cybersecurity GRC, or technology audit experience (mid-to-senior scope)\nExperience building, scaling, or maturing a TPRM program at a technology, cloud, AI, or fintech company, ideally in a high-growth environment\nDemonstrated experience running vendor security assessments end to end across a diverse vendor population, including issuing questionnaires, evaluating evidence, assigning risk ratings, and driving remediation\nHands-on experience reviewing SOC 2 reports, ISO 27001 certifications, and penetration test summaries, including identifying scope limitations, carve-outs, exceptions, and CUECs\nSolid understanding of common security and compliance frameworks (e.g., SOC 2, ISO 27001, NIST CSF, NIST SP 800-53) and how vendor controls map to them\nWorking technical fluency on-prem and in cloud environments (AWS, GCP, or Azure), SaaS architectures, identity and access management, encryption, data flows, incident response, and business continuity and disaster recovery - enough to evaluate vendor responses and speak credibly with engineers and vendors\nExperience partnering with Legal and Procurement on vendor contract security and privacy terms (e.g., security addendums, DPAs)\nStrong written and verbal communication skills, with the ability to explain risk and tradeoffs to procurement, legal, engineering, and business audiences\nFamiliarity with AI governance topics relevant to vendor diligence (e.g., model data handling, training-data boundaries, ISO 42001 / NIST AI RMF concepts, EU AI Act awareness)\nExperience with GRC and TPRM platforms such as Vanta, Drata, OneTrust, ServiceNow VRM, Archer, or similar, and with security ratings tools (e.g., SecurityScorecard, BitSight, UpGuard)\nExperience managing supply chain and vendor risk for data center hardware, including hardware compliance\nExperience automating TPRM workflows with scripting, low-code, or AI-assisted tooling, such as intake forms, tiering logic, questionnaire analysis, evidence collection, and reassessment triggers\nWorking knowledge of data privacy frameworks (e.g., GDPR, CCPA, HIPAA) as they apply to vendors and sub-processors\nExperience with supply-chain and fourth-party risk analysis, including concentration risk and business continuity for critical vendors\nExperience supporting internal audits, external audits, or regulatory examinations with third-party risk evidence\nComfort operating with ambiguity - setting precedent and documenting new standards where none exist, while keeping assessments consistent and defensible\nCertifications such as CTPRP, CISSP, CISA, CISM, CRISC, CIPP/US, CIPT, ISO 27001 Lead Auditor, or similar preferred\nExperience supporting public sector, financial services, or other highly regulated vendor oversight requirements (e.g., FedRAMP, NIST 800-171, PCI DSS, DORA) is a plus\nADDITIONAL REQUIREMENTS:\nThis role may require occasional travel\nAbility to work effectively in a fast-paced, high-growth environment with evolving priorities\nMust be able to handle sensitive vendor and security information with discretion\nCOMPENSATION AND BENEFITS:\n$132,000 - $228,000 USD\nBase salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks.\nITAR REQUIREMENTS:\nTo conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here. \nSpaceXSI is an equal opportunity employer. For details on data processing, view our Recruitment Privacy Notice.","description_format":"text","description_chars":9785,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Equity","Insurance coverage","Life insurance","Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["LLM & Generative AI","Security Compliance","Foundation Models","AI Research Labs"],"lifecycle":[{"event":"open","at":"2026-11-10T21:56:11Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"Filed H-1B visas in the last two years","filings_12m":0,"filings_prev_12m":1,"green_card_filings_12m":0,"median_offered_wage_usd":null,"route":null,"cap_exempt":false,"checked_at":"2026-11-12T07:36:15+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":1,"expected_fill_days":68,"reasons":["conf:2","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-11-12T10:38:37Z"},"pay":{"stated_usd_annual":228000,"is_top_pay":true},"html_url":"https://alion.io/job/xai-sr-security-analyst-third-party-risk-management","json_url":"https://alion.io/job/xai-sr-security-analyst-third-party-risk-management.json","meta":{"generated_at":"2026-11-13T17:20:06Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":34696,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":28},"rest":"https://alion.io/mcp/rest/get_company?id=28"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fxai-sr-security-analyst-third-party-risk-management"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fxai-sr-security-analyst-third-party-risk-management"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fxai-sr-security-analyst-third-party-risk-management"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/xai-sr-security-analyst-third-party-risk-management\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fxai-sr-security-analyst-third-party-risk-management"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4040166}},{"tool":"search_jobs","arguments":{"company":"x.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4040166},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}