Roblox is hiring a
Principal Third Party Security Risk Analyst

As a Principal Third-party Risk Analyst, you will be a founding member of the Roblox Third-party Risk Management team, reporting to the Manager of Third Party Risk and Oversight. You will strengthen the security posture of the company by identifying, analyzing, prioritizing, and remediating risks associated with Roblox's Third party vendor engagements.

You are expected to establish and own the Third Party Risk Control Matrix, to clearly outline and report on: general risks, control expectations - and failures, regulatory requirements, and internal requirements.

You Will:

• Help us measure and right size risk for the globally distributed workforce that supports the Roblox platform.
• Build the foundation for the third party risk management program, ensuring that the level of oversight is commensurate with the level of risk and complexity associated with each of our partnerships.
• Build strong relationships with other teams while providing informed suggestions for identified control failures - working cross functionally with system owners to implement remediations.
• Scale impact as the company grows by streamlining and automating processes that help us capture and understand risk.
• Use industry standard frameworks to systematically and continually analyze the risk of off-shore global business operations
• Assess, map, and protect an evolving threat landscape as operations scale and grow in complexity
• Perform gap analysis, and through technical reporting, provide recommendations to satisfy controls
• Convert objective technical risks into tangible business goals
• Partner with multiple third party business operations to implement and enforce a standardized security posture
• Act as liaison between our third parties and internal teams, bridging gaps to enable a defense in-depth model

You Have:

• 8+ years of relevant professional experience in the Information Security Risk/Audit space.
• BA/BS degree in a relevant field or equivalent experience.
• Up-to-date, working knowledge, and experience with CIS Controls and common Benchmarks
• Experience with compliance frameworks:
  • NIST CSF
  • ISO27001
  • SOX
• Working knowledge of regulatory law:
  • GDPR
  • CCPA
  • COPPA
• Experience being self-organized, with high attention to detail
• Excellent prioritization and execution skills
• Excellent written and verbal communication skills

You Are:

• Results driven: an individual who values moving progress forward.
• Team-oriented: a collaborative team player who enjoys working with others.
• Passionate about security: You have significant experience in information security.