Job Opportunities API

  Vendor Risk Manager ​   Dalio Family Office   Dalio Family Office Overview:    The Dalio Family Office (DFO) supports Barbara and Ray Dalio and their family in their ventures, investments, and philanthropic efforts under Dalio Philanthropies, which includes OceanX, Dalio Education, Endless Network, and the Beijing Dalio Foundation. The core of the DFO’s culture is built around meaningful work and meaningful relationships and the family’s commitment to giving back. The office is headquartered in Westport, CT with regional offices in New York City, Singapore, and Abu Dhabi.   Position Summary:    ​ ​ The Vendor Risk Manager owns the end-to-end third-party risk lifecycle, onboarding, diligence, monitoring, and exit across a high-volume, diverse vendor portfolio. You will synthesize risk across cybersecurity, AI, privacy, financial, and AML/CFT/sanctions domains into clear, actionable risk positions, performing structured threat modeling for high-exposure vendors. ​   Day-to-day responsibilities would include a combination of the following:   Own the VRM program end-to-end: strategy, policy, procedure, workflow, tooling, metrics, and executive reporting for CISO/CRO/board visibility. ​ Lead holistic vendor risk assessments across cybersecurity, AI risk, privacy, financial, AML/CFT/sanctions. Document residual risk acceptances with named accountable executives and time-boxed review dates; coordinate with IT, Legal, Finance, and Compliance as appropriate.   ​Evaluate and monitor vendor security controls based on data sensitivity and business criticality, leveraging industry frameworks and evidence such as SOC 2, ISO 27001, penetration testing, and security assessments.   Conduct structured threat models (STRIDE, PASTA) for high risk vendors, a nd document findings as durable artifacts informing contracting, monitoring, and exit planning.   Translate threat model outputs into concrete, testable control requirements drawing from OWASP (ASVS, API Security Top 10, LLM/Agentic Top 10), NIST (SP 800-53, SP 800-161, CSF 2.0, SP 800-207), and MITRE ATT&CK; scale requirements to vendor tier.   Partner with Legal to translate identified risks into enforceable contractual requirements. Apply FAIR or comparable quantitative methods for high-impact vendor decisions, expressing cyber risk in loss-exposure terms that resonate with senior leadership.   Advise IT, Engineering and business teams on vendor integration architecture (SSO/SCIM, OAuth, conditional access, DLP, segmentation, BYOK, VPC peering) and maintain approved reference patterns. ​ Drive automation and tooling maturity to handle high vendor volume without proportional headcount growth; produce program dashboards tracking throughput, cycle time, recertification compliance, and remediation aging .   ​ ​ The ideal candidate will possess the following knowledge, skills, attributes, and values:   Expert knowledge of third-party/vendor risk management   Strong risk assessment and analytical skills   Technical understanding of enterprise security architecture   Excellent communication and stakeholder management skills   Proven ability to lead and optimize vendor risk programs     Illustrative Benefits:        100% company paid medical premiums   17 company paid holidays   Friday summer hours    Monthly community happy hours    Hybrid work environment    Free catered food services for in-office days    Generous PTO offering    Casual dress code   150% 401(k) match up to $7,500 and 100% match above $7,500 ($15k match limit)   Gym rei