Lead Analyst, Security Strategy & Assurance

If you thrive at the intersection of risk, compliance, and strategic impact, this role offers a unique opportunity to define and lead two of the most critical programs within OutSystems’ Security function. As a Lead Analyst on the Security Strategy and Assurance team, you will own our Third Party Risk Management (TPRM) program and drive enterprise risk activities that directly shape how OutSystems manages risk across its vendor ecosystem and broader business. This is a lead role, meaning you will operate with significant autonomy, define the scope and approach for complex, cross-functional initiatives, and serve as the go-to expert in your domain. You will architect solutions to close gaps between current practices and desired outcomes, build lasting stakeholder relationships, and mentor junior colleagues on the team.

Responsibilities

Own and mature the Third Party Risk Management (TPRM) program; Define and drive OutSystems’ TPRM strategy, including risk tiering methodology, assessment frameworks, and ongoing monitoring cadences; Lead end-to-end vendor risk assessments and architect scalable processes; Maintain the vendor risk inventory and track remediation of identified issues; Lead enterprise risk activities; Own and evolve the enterprise risk register for the Security division; Design and facilitate risk workshops; Develop key risk indicators (KRIs) and produce executive-level risk reporting; Drive compliance strategy and audit readiness; Serve as a senior contributor to compliance programs supporting certifications such as SOC 2, ISO 27001, PCI, HIPAA; Act as the primary point of contact for internal and external audits related to vendor and enterprise risk controls; Drive operational excellence and process improvement; Lead the adoption and optimization of GRC tooling and automation; Mentor, influence, and build; Mentor team members; Develop and maintain policies, standards, and procedures that govern TPRM and enterprise risk

Requirements

Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent experience; 7–10 years of experience in information security, risk management, or compliance, with at least 3–4 years focused on third-party or vendor risk; Demonstrated experience owning and maturing a TPRM program, including framework design, risk tiering, and remediation management; Strong working knowledge of enterprise risk management frameworks (e.g., NIST RMF, ISO 31000, COSO) and security control frameworks (ISO 27001, SOC 2, NIST CSF); Experience supporting or leading internal and external audits across certifications such as SOC 2, ISO 27001, or equivalent; Ability to operate with significant autonomy, define scope on complex and ambiguous projects, and drive cross-functional alignment; Excellent communication skills

Nice to have

Professional certifications such as CRISC, CISM, CISSP, CISA, or ISO 27001 Lead Implementer/Auditor; Familiarity with GRC platforms; Knowledge of emerging third-party risk regulations such as DORA, NIS2, or CMMC; Experience with PCI DSS, HIPAA, or regional compliance frameworks; Background in a SaaS or cloud technology company environment; Experience mentoring or coaching junior team members

Benefits

A company at the vanguard of the agentic revolution; Real growth opportunities with structured programs; Professional Development Fund; Internal Mobility Program; A global collective of world-class talent with accessible mentors; Inclusive culture