Information Security Analyst II - Security and Privacy Vendor Risk

We are seeking a highly skilled and experienced Security and Privacy Vendor Risk Analyst. This individual will play a pivotal role in ensuring that our vendors and third parties adhere to Datadog’s security, privacy, and compliance standards. This analyst will manage the evaluation and risk assessment of third-party vendors, ensuring alignment with Datadog's security and privacy policies, regulatory requirements, and risk management framework. Acting as a bridge between technical teams (such as IT security, legal, and procurement) and business stakeholders, this role ensures clear communication and risk mitigation strategies to support the vendor onboarding from review to implementation.

Datadog is building a world-class security and privacy risk management program to safeguard our data and systems from real-world threats. You will help us navigate the challenges presented by an evolving vendor ecosystem and a constantly changing regulatory landscape.

What You'll Do: 

• Work cross-functionally with legal, procurement, IT, privacy and security teams to evaluate vendor risks and develop mitigation strategies.
• Continuously iterate and improve the Vendor Risk Management Program to align with Datadog’s risk appetite and regulatory obligations.
• Assess vendors' security and privacy controls, ensuring data handling practices align with Datadog's policies, best practices, and industry standards such as GDPR, CCPA/CPRA, HIPAA, and ISO 27001.
• Evaluate security and privacy risks associated with vendor engagements, including data processing, storage, and access.
• Support daily operational security and privacy risk activities, including vendor assessments, contract reviews, compliance documentation, and risk reporting.
• Support daily governance operations within the security and privacy domain, including subprocessor management, data inventory maintenance, and M&A support.
• Digest complex vendor risk requests from stakeholders, identify key risks, and develop concrete recommendations to reduce risks to Datadog.
• Develop deep technical authority on vendor risk management practices and be able to articulate security and privacy risk mitigation strategies to multiple levels of the organization.

Who You Are:

• You have a BS or equivalent experience.
• You have 3 or more years of experience in vendor risk management, security risk assessments, privacy risk, or compliance.
• You possess a keen eye for detail and a strong writing ability, making you well-equipped to document vendor risk findings, security controls, and compliance measures.
• You have experience in day-to-day security and privacy risk management, including vendor due diligence, contract negotiations, and third-party assessments.
• You have a strong understanding of security and privacy risk frameworks such as GDPR, CCPA/CPRA, HIPAA, ISO 27001, SOC 2, and NIST.
• You have experience with third-party risk management platforms and risk assessment methodologies.
• You are comfortable working in a fast-paced, high-growth environment.

Bonus Points:

• You take pride in your writing ability and have been praised for it.
• You have experience with vendor risk assessment tools and security ratings platforms.
• You have experience with data security, encryption, and access control methodologies.
• You have project management experience related to vendor risk.
• You have familiarity with cloud security and SaaS risk management.