Cybersecurity GRC Sr Analyst

About the role

This position is a senior analyst role within PepsiCo’s Third‑Party Security Risk Management Team. The analyst will ensure that cybersecurity clauses are properly embedded and negotiated in third‑party contracts and will drive key security deliverables from selected vendors.

Key responsibilities

• Advise internal teams on appropriate cybersecurity clauses for third‑party agreements.
• Collaborate with third‑party legal and security teams to review, negotiate, and amend cybersecurity provisions.
• Verify that all relevant contracts include required cybersecurity language.
• Ensure compliance with organizational and contractual security standards, including SLAs and KPIs.
• Work with IT Vendor Relationship Management to measure supplier performance and define security requirements.
• Produce accurate, timely supplier analytics and performance reports for Information Security and broader IT stakeholders.
• Analyze and communicate security risks related to supplier performance to leadership.
• Develop and document best‑practice processes for the security metrics program.

Required profile

• Self‑directed professional with strong analytical abilities.
• Experience with regulatory compliance frameworks such as GDPR and NIS 2.
• Familiarity with information‑security management frameworks (NIST CSF, ISO 27001/27002, SOX, COBIT).
• Ability to identify data‑quality measures and recommend corrective actions.
• Excellent written and verbal communication skills in English, capable of explaining complex security concepts to non‑technical stakeholders.

Required skills

• GDPR
• NIS 2
• NIST Cybersecurity Framework (CSF)
• ISO 27001/ISO 27002
• SOX
• COBIT