Security Analyst – Third Party & Trust Center

About the role

The Security Analyst will lead third‑party risk assessments and manage Elsevier’s Trust Center, ensuring compliance with contractual, security and regulatory requirements. You will work closely with legal, procurement, privacy and product teams to protect data and support customer due‑diligence processes.

Key responsibilities

• Assess global vendors for compliance with security standards, contractual obligations and regulatory mandates, documenting data flows, usage and connectivity.
• Maintain assessment records in a GRC/TPRM platform (e.g., OneTrust) and monitor timelines, expiry dates and reassessment cadences.
• Identify gaps in existing processes, drive remediation of control deficiencies, and keep the third‑party risk register up‑to‑date.
• Curate and publish customer‑facing security documentation in the Trust Center, including certifications, policies and FAQs.
• Respond to inbound security questionnaires (SIG, CAIQ, RFP/RFI) in partnership with sales, legal and product owners.
• Support internal and external audit inquiries related to third‑party risk and Trust Center content.

Required profile

• 2–3 years of experience in information security compliance, third‑party risk management or IT audit.
• Strong understanding of security and privacy standards such as ISO 27001/27017, ISO 27701/27018, HIPAA, PCI DSS and NIST 800‑53.
• Excellent communication skills to explain complex compliance requirements to internal stakeholders and external customers.
• Ability to work effectively in a global, cross‑functional team and manage multiple priorities under tight deadlines.

Required skills

• OneTrust (or similar GRC/TPRM platform)
• SafeBase, Optro (AuditBoard) or comparable trust‑center tooling
• Interpretation of data‑flow diagrams and data‑privacy impact analysis
• Knowledge of ISO 27001, ISO 27701, HIPAA, PCI DSS, NIST 800‑53 frameworks