Analyst, Information Security GRC at Edwards… · Cartago

Analyst, Information Security GRC Location: Costa Rica-Cartago-BSC Innovation starts from the heart. At Edwards Lifesciences, we’re dedicated to developing ground-breaking technologies with a genuine impact on patients’ lives. At the core of this commitment is our investment in cutting-edge information technology. This supports our innovation and collaboration on a global scale, enabling our diverse teams to optimize both efficiency and success. As part of our IT team, your expertise and commitment will help facilitate our patient-focused mission by developing and enhancing technological solutions. This role is responsible for executing Third Party Risk Management (TPRM) activities to support effective vendor risk identification, assessment, and issue management across the organization. The position focuses on third party security due diligence, evidence review, risk issue tracking, and metrics enablement, working closely with internal stakeholders and external vendors to ensure governance, compliance, and transparency in third party risk processes. How´ll make an impact: Risk & Third-Party Risk Execution: Manage vendor security risk assessments, including following up on incomplete or pending Information Risk Questionnaires. Review Third Party Intake Form (TPIF) queues and request clarifications or additional information from requesters. Trigger, monitor, and track third party assessments. Escalate nonresponsive third parties in accordance with defined service expectations. Evidence & Due Diligence Review: Review submitted evidence for completeness and sufficiency, including certifications and supporting documentation (e.g., ISO certificates, Statements of Applicability). Request missing, outdated, or insufficient evidence as required to complete due diligence reviews. Assess third party due diligence results and support approval of TPIF tickets. Issues Management: Open, document, and track risk issues related to identified third party control deficiencies. Support issue lifecycle management, including remediation tracking and status updates. Coordinate with internal stakeholders as needed to resolve third party related risk items. Data, AI & Metrics Enablement: Support expansion of third-party due diligence to assess supplier Data and AI governance practices Contribute to dashboard execution, reporting accuracy, and processing automation efforts. Assist in improving transparency and reducing manual effort across TPRM reporting and operations. General Responsibilities: Execute defined TPRM processes consistently and in accordance with governance requirements. Support continuous improvement of tools, workflows, and documentation. What we look for (Required): Bachelor’s degree in information security, Computer Science, Information Systems, or a related field and 2+ years of experience in information security, risk management, compliance, or a related governance or operational role. What else we look for (Preferred): Experience supporting vendor risk assessments or due diligence activities. Experience building and managing security metrics and dashboards with PowerBI. Working knowledge of cybersecurity and information security risk principles. Experience supporting governance processes related to data governance and responsible AI. Experience working with TPRM platforms or GRC tools. Experience reviewing third party security documentation and certifications. Professional certifications such as Security+, GISP, CRISC, GSEC, GISF, or similar. Strong attention to detail and ability to identify gaps in documentation or evidence Clear written and verbal communication skills for engaging internal stakeholders and third parties. Ability to manage high volume workflows and competing priorities. Comfort operating in structured, process driven environments. Analytical mindset with a focus on risk identification and tracking. Reliable execution and follow through in operational tasks.