Smartsheet is seeking a dedicated, experienced Third Party Risk Management (TPRM) Senior Analyst to join our Risk team. This is a high-visibility, cross-functional role that requires sustained focus and ownership; you will be a primary point of contact for vendor risk across the organization, interfacing regularly with cross-functional teams (Legal, Procurement, Privacy, and Information Security) as well as system owners.

This role is a meaningful commitment. You will own a portfolio of vendor assessments and help drive program maturity. We are looking for someone who brings deep focus and genuine investment to this work, the kind of professional who sees TPRM not as a checkbox function but as a critical enabler of trust for a global SaaS platform.

You will report to the Third Party Risk Integration Manager located in the US. This role is eligible for remote work within Costa Rica. You  must reside in Costa Rica.

^{You Will}

• Lead end-to-end Third Party Risk Assessments for new and existing vendors, including vendor tiering, scoping, questionnaire management, and findings documentation.
• Own the ongoing monitoring and tracking of vendor risk across Smartsheet's third-party portfolio, ensuring timely follow-up on remediation activities and risk acceptance decisions.
• Evaluate vendor security documentation including SOC 2 reports, penetration testing results, ISO certifications, and other control attestations — and translate findings into clear, actionable risk summaries for stakeholders.
• Drive process improvement initiatives within the TPRM program, identifying opportunities to scale and mature the program through better tooling, automation, and workflow design.
• Collaborate cross-functionally with Legal, Procurement, Information Security, Privacy, and business stakeholders to ensure vendor risk considerations are embedded in sourcing and renewal decisions.
• Leverage AI tools (including Claude and Microsoft Copilot) to increase efficiency in vendor reviews and documentation — while applying sound judgment to review, validate, and take accountability for AI-generated outputs.
• Contribute to broader risk program activities including risk reporting, policy review, and program documentation as part of a lean, high-performing Risk team.
• Support the development of TPRM metrics and reporting to provide leadership with meaningful visibility into the organization's third-party risk exposure.
• Other job duties as assigned

You have

• 5+ years of experience in third party risk management, vendor risk, GRC, information security, audit, or compliance — with direct experience conducting vendor or third-party risk assessments.
• Practical knowledge of one or more risk or regulatory frameworks such as NIST, ISO 27001, COSO, COBIT, AICPA SOC/TSP, PCI DSS, or similar.
• Familiarity with vendor security questionnaire frameworks, including SIG (Shared Assessments) and/or CSA CAIQ.
• Demonstrated ability to review and interpret SOC 2 reports, penetration testing summaries, and other vendor security attestations.
• Experience working in cross-functional environments involving Legal, Procurement, and/or Engineering stakeholders.
• Strong written and verbal communication skills in English, with the ability to translate technical risk findings into clear business language.
• Effective critical thinking and judgment — able to assess risk materiality, prioritize competing demands, and escalate appropriately.
• Comfort working with and evaluating AI-generated content, with a clear understanding of the need to verify outputs before relying on them in risk decisions.
• Adaptability to evolving regulatory requirements and a genuine interest in staying current on the third-party risk landscape.

Nice to have

• Experience with vendor risk management platforms such as AuditBoard, Archer, OneTrust, ServiceNow GRC, Vanta, or Coupa.
• Background in SaaS, cloud, or technology company environments.
• Familiarity with AI-assisted workflows in a GRC or compliance context.
• Experience supporting or contributing to audit processes (e.g., SOC 2, ISO 27001, BARR).
• Relevant certifications such as CISA, CRISC, CTPRP, or equivalent.
• Experience with operational risk across multiple business units, legal entities, or jurisdictions.

Teleworking options from any registered location in Costa Rica (role specific)

The Senior Analyst, Information Security will be a part of the team responsible for assisting clients and prospects with security and privacy inquiries, managing the daily flow of questionnaires, assessments, and trust related requests, and security and compliance strategy to protect Movable Ink’s platform. You'll work closely with leaders from around the organization to support a strong security posture aimed at protecting our customers' data. This includes ensuring that information security controls are operating effectively and incrementally improved.

Responsibilities:

• Triage, prioritize, and manage incoming client and prospect security requests across email, Zendesk, and other intake channels.
• Investigate and troubleshoot complex issues, perform root-cause analysis, provide advice on risk management strategies, and support the implementation of risk mitigation measures 
• Review various manual processes across the program and find innovative solutions to use automation where possible for process efficiency 
• Coordinate across a variety of teams to gather information and resolve client inquiries
• Perform light TPRM intake and triage, including logging new vendor requests and coordinating basic review steps.
• Support the TPRM process by tracking vendor assessments and maintaining status visibility for stakeholders.
• Assist with internal and external audits, ensuring security practices comply with relevant regulations.
• Stay informed of industry trends, security threats, and regulatory changes, recommending adjustments to access control policies as needed.

Qualifications:

• 3-5 years of experience in a security analyst focused role
• Foundational knowledge of information security, compliance, and SaaS environments
• Experience working with ticketing platforms and Trust Center platforms (or similar tools)
• Excellent troubleshooting skills and the ability to logically think through problem resolution
• Strong communication skills across all levels and departments of the organization
• Must possess high attention to detail and the ability to prioritize work while successfully managing multiple projects and deadlines with minimal oversight
• Exposure to privacy or security-related compliance frameworks preferred (e.g., SOC2, ISO 27,000 series, and GDPR)
• Security related certification(s) a plus

The Deal Desk team’s primary objective is to ensure that complex, high-value deals make their way through internal processes with cross-functional alignment with a focus on achieving the company’s objectives. As a key member, you will help shape negotiation strategies for complex deals and become a trusted advisor to the sales team. If you are a highly motivated individual who thrives in a fast-paced environment and is not afraid to take initiative, this is the right role for you.

Responsibilities:

• Manage non-standard deals through the review process to assess risk, ensure quality assurance, business, and operational compliance
• Collaborate with various teams such as sales, legal, and finance to facilitate deal execution and resolve any issues or conflicts that may arise during the process
• Maintain commercial details in Salesforce and help standardize custom terms across regions, products and channels to enable predictable outcomes
• Serve as a trusted advisor by providing guidance and insights to the sales team on optimal deal structure and pricing
• Assist in streamlining key operational workflows to support efficient and sustainable growth
• Drive improvements in reporting and dashboards to measure outcomes and track key metrics
• Provide ongoing support in documenting our processes as well as best practices and lessons learned in deal strategy
• Foster a high-performing team environment by proactively seeking out opportunities for personal and team development

Qualifications:

• 3+ years of experience in a relevant field (e.g. sales operations, revenue operations, order management, or deal strategy, tech/SaaS background a plus)
• Proficiency in Salesforce (CPQ a plus), Excel, and Google Sheets
• Ability to build relationships and trust with internal stakeholders at all levels across all functions
• Project management and risk assessment abilities
• Operates with minimal supervision and high discretion
• Organizational and analytical skills
• Out of the box thinker and ability to think creatively to solve problems