About the role
Functional Title: Third-Party Security Analyst
Experience: 7+ years
Company Description
Tradeweb Markets is a world leader in the evolution of electronic trading. A fintech company serving approximately 2,500 clients-including the world's largest banks, asset managers, hedge funds, insurance companies, wealth managers, and retail clients-in more than 65 countries across the globe. Since our first trade in 1998, we have helped transform and electronify the fixed income markets.
Tradeweb is a culture built on innovation, creativity, and collaboration. Through a combination of incredibly talented and driven people, innovative products and solutions, cutting-edge technology, market data, and a vast client network, we continue to work together to improve the way financial markets trade.
Mission: Move first and never stop. Collaborate with clients to create and build solutions that drive efficiency, connectivity, and transparency in electronic trading.
Tradeweb Markets LLC ("Tradeweb") is proud to be an EEO Minorities/Females/Protected Veterans/Disabled/Affirmative Action Employer.
https://www.dol.gov/ofccp/regs/compliance/posters/pdf/eeopost.pdf
Group Details
Tradeweb's Cyber Security team plays a critical role in protecting the firm, its clients, and its employees from an evolving third-party threat landscape. The Vendor Cyber Risk Analyst will be responsible for assessing, monitoring, and managing cybersecurity risks introduced by third-party vendors and service providers.
This role works closely with Procurement, Legal, Compliance, Technology, and Business teams to ensure vendor risks are identified, assessed, and mitigated in alignment with Tradeweb's risk appetite and regulatory obligations. The ideal candidate brings strong cyber risk fundamentals, excellent communication skills, and experience operating in regulated financial environments.
Job Responsibilities
Lead and perform cybersecurity risk assessments for third-party vendors, suppliers, and service providers
Review and analyze vendor security artifacts, including SOC 1/SOC 2 reports and ISO 27001 certifications
Review penetration testing summaries, architecture diagrams, technical documents, and security policies
Evaluate vendor responses to cybersecurity questionnaires and due diligence requests
Define vendor risk ratings and document identified risks, gaps, and remediation plans
Partner with Risk, Procurement, and Legal teams to support vendor onboarding and contract reviews
Track vendor remediation efforts and follow up on outstanding risk items
Monitor vendor-related security incidents and escalate issues in accordance with incident response procedures
Act as a subject matter expert and advisor to internal stakeholders on vendor cyber risk matters
Maintain vendor risk records, metrics, and reporting within GRC or vendor risk management platforms
Drive continuous improvement of third-party cyber risk management processes, standards, and controls
Support regulatory exams, audits, and internal reviews related to third-party cyber risk
Required Qualifications
7+ years of experience in cybersecurity, IT risk management, third-party risk management, or information security
Strong understanding of cybersecurity principles, including access control, data protection, network security, and incident response
Hands-on experience reviewing vendor security documentation (SOC reports, ISO certifications, risk assessments)
Solid knowledge of security frameworks and standards such as NIST, ISO 27001, SOC, and CIS
Experience using GRC or third-party risk management tools
Ability to assess and communicate risk clearly to both technical and non-technical stakeholders
Strong analytical, documentation, and organizational skills
Proven ability to manage multiple vendor assessments simultaneously and meet deadlines with minimal supervision
Basic awareness of AI-enabled features within cybersecurity or vendor risk platforms (e.g., automated risk scoring, workflow automation)
Ability to interpret AI-assisted insights and apply human judgment to validate findings
Preferred Qualifications
Experience in financial services or other highly regulated industries
Professional certifications such as CISA, CRISC, CISSP, or Security+
Familiarity with security rating services (e.g., BitSight, SecurityScorecard)
Experience producing KPIs and risk reporting for senior management