Job Description: SaaS Security Posture & Third-Party Risk Engineering Lead: 6-9 years (Advanced)

Job Description: SaaS Security Posture & Third-Party Risk Engineering Lead

Remote

U.S Citizen, Green Card Only

Job Overview

We are seeking an experienced SaaS Security Posture & Third-Party Risk Engineering Lead to drive enterprise-wide SaaS security posture management (SSPM), continuous security controls assessment, and third-party risk monitoring. This role combines security engineering, risk analytics, automation, cloud security, and governance to identify, assess, prioritize, and mitigate security risks across enterprise SaaS applications and third-party vendor ecosystems.

The successful candidate will design and implement automated security monitoring capabilities, develop real-time exposure analytics, leverage Python and AI/ML techniques for risk detection, and establish continuous controls validation frameworks. The role will partner with Security Operations, Cloud Security, Enterprise Architecture, Governance, Risk and Compliance (GRC), Procurement, Legal, and business stakeholders to strengthen the organization's security posture and third-party risk management program.

The ideal candidate brings a strong engineering mindset, hands-on experience with SaaS and cloud security, expertise in security automation and analytics, and the ability to translate technical risks into actionable remediation plans and executive-level reporting.

Key Responsibilities

1. SaaS Security Posture Management (SSPM)

• Design, implement, and maintain enterprise SaaS security posture management capabilities.
• Assess the security configurations of SaaS applications, including identity and access management, privileged access, data sharing, integrations, audit logging, and security controls.
• Identify SaaS misconfigurations, excessive permissions, insecure integrations, exposed sensitive data, and policy violations.
• Establish continuous monitoring and configuration assessment across enterprise SaaS platforms.
• Develop security baselines, configuration standards, and control validation frameworks aligned with organizational security policies.
• Integrate SaaS security telemetry with SIEM, SOAR, cloud security, and risk management platforms where appropriate.
• Partner with application owners and SaaS administrators to remediate security findings and prevent recurring misconfigurations.

2. Third-Party Risk Management (TPRM) Engineering

• Develop and enhance continuous third-party security risk monitoring capabilities.
• Assess vendor security posture based on available security assessments, control evidence, external risk signals, vulnerabilities, and compliance information.
• Automate the collection, normalization, and analysis of vendor security data from internal and external sources.
• Build risk-scoring methodologies that evaluate vendor criticality, data sensitivity, access privileges, control maturity, and potential business impact.
• Monitor vendor security changes, material incidents, emerging vulnerabilities, and changes in risk exposure.
• Integrate third-party risk workflows with procurement, vendor onboarding, contract reviews, and ongoing risk reassessments.
• Collaborate with Procurement, Legal, Privacy, Compliance, and business owners to track remediation plans and risk acceptance decisions.
• Maintain defensible audit trails and evidence supporting vendor risk decisions.

3. Continuous Controls Assessment and Compliance Monitoring

• Build automated frameworks for continuous security control assessment and validation.
• Map technical security controls to applicable frameworks and internal policies, such as NIST Cybersecurity Framework, NIST SP 800-53, ISO 27001, CIS Controls, and SOC 2 Trust Services Criteria, as applicable.
• Automate evidence collection, control testing, compliance checks, and exception tracking.
• Detect control drift and identify gaps between required security baselines and actual configurations.
• Develop dashboards that provide visibility into control effectiveness, unresolved findings, remediation progress, and residual risk.
• Work with GRC and audit teams to support internal audits, external assessments, and regulatory compliance requirements.
• Establish repeatable processes for risk identification, prioritization, remediation, validation, and closure.

4. Security Engineering and Automation

• Design and develop scalable security automation solutions using Python and relevant APIs.
• Build integrations with SaaS platforms, cloud services, vulnerability management tools, GRC systems, and security monitoring platforms.
• Develop automated workflows for risk detection, alert enrichment, evidence collection, remediation tracking, and escalation.
• Implement data ingestion, normalization, correlation, and enrichment pipelines for security and vendor risk information.
• Apply software engineering best practices, including modular design, testing, version control, documentation, and secure coding.
• Evaluate and integrate security tools and open-source technologies based on effectiveness, scalability, reliability, and security.
• Improve the accuracy, efficiency, and operational reliability of security monitoring processes.

5. Real-Time Exposure Analytics and AI/ML-Based Risk Detection

• Develop analytics capabilities to identify emerging security exposures across SaaS applications and third-party ecosystems.
• Apply statistical analysis, machine learning, and anomaly detection techniques to identify unusual configuration changes, suspicious access patterns, control failures, and emerging risk indicators.
• Build risk correlation and prioritization models that combine technical severity, business criticality, exploitability, data sensitivity, and vendor importance.
• Evaluate AI/ML models for detection quality, false-positive reduction, explainability, and operational usefulness.
• Integrate risk analytics into security