As Navan continues to scale globally, our ecosystem of vendors and partners grows with us. We are looking for a Third-Party Risk Analyst to join our Security & Compliance team. In this role, you will be the gatekeeper of our vendor lifecycle, ensuring that every third party—from software providers to Travel Management Companies (TMCs)—meets our rigorous security and privacy standards. You will sit at the intersection of Procurement, Legal, and Security, driving the risk assessment process and ensuring that Navan’s data remains protected across our entire supply chain.
What You’ll Do- Risk Assessment Ownership: Conduct comprehensive security and privacy risk assessments for new and existing third parties using procurement and GRC tools and partner with Security leadership to escalate high-risk vendors and support documented risk acceptance or remediation decision
- Vendor Due Diligence: Review SOC2 reports, ISO certifications, and penetration test summaries to identify potential vulnerabilities in a vendor’s posture.
- Contractual Redlining: Partner with Legal to review and redline Security Addendums and Data Processing Addendums (DPAs), ensuring vendors commit to Navan’s required security controls.
- Vendor Engagement: Lead the outreach to vendor security teams to clarify questionnaire responses, follow up on remediation items, and ensure compliance with our standards.
- TMC & Partner Management: Work closely with our Travel Management Companies to gather essential security documentation and manage the lifecycle of partner-specific risk reviews and contracts.
- Continuous Monitoring: Monitor the existing vendor landscape for security incidents, certification expirations, for security alerts, news of breaches, or changes in risk profiles, and trigger re-assessments when necessary.
- Cross-Fuctional Collaboration: You will work closely with Procurement, Legal, Privacy, and Engineering teams on third-party security and risk considerations throughout the vendor lifecycle
- Experience: 2–4 years in Third-Party Risk Management (TPRM), Vendor Risk, or IT Audit.
- Regulatory Knowledge: Familiarity with privacy frameworks (GDPR, CCPA) and security standards (SOC 2, ISO 27001).
- Procurement Savvy: Experience working within procurement workflows and using GRC or Vendor Management tools (e.g., OneTrust, Prevalent, or Vanta).
- Analytical Mindset: Ability to spot "red flags" in a vendor’s security documentation and translate those risks into business impact for internal stakeholders.
- Negotiation Skills: Comfortable holding vendors accountable and negotiating security terms in contracts.
- Organization: You can manage dozens of active vendor assessments simultaneously without losing track of deadlines or documentation gaps.
Top Skills
What We Do
Navan (Nasdaq: NAVN) is the leading all-in-one business travel, payments, and expense management platform that makes travel easy for frequent travelers. From finding flights and hotels to automating expense reconciliation, with 24/7 support along the way, Navan delivers an intuitive experience travelers love and finance teams rely on. See how Navan customers benefit and learn more at navan.com.
Why Work With Us
At Navan, we’re never satisfied with the status quo, and we know breakthrough ideas come from diverse perspectives. We are committed to cultivating a workplace that reflects the diversity of the customers we serve while fostering leadership and innovation.
Gallery
Navan Offices
Hybrid Workspace
Employees engage in a combination of remote and on-site work.
In-person connections is the foundation of Navan, the connections forged through face-to-face interactions improve company culture and what we can achieve together. We operate on a hybrid working model, which we define as four days a week in-office.
.png)
