Technical Security Analyst

About The Role: Technical Security Analyst at Shopify

We are seeking a curious and detail-oriented individual to join Shopify’s Third Party Security team as a Technical Security Analyst. In this role, you will apply your technical skills and security fundamentals, alongside your growing understanding of Shopify’s products, applications, and infrastructure, to assess and manage third-party vendor risk. You will support and operate technical controls, refine team playbooks, and collaborate cross-functionally to ensure security is paramount while enabling Shopifolk to achieve their goals.

This position offers a chance to:

• Support third-party/vendor security reviews by gathering evidence, validating responses, and documenting outcomes.
• Utilize established frameworks and playbooks to identify control gaps and escalate risks as needed.
• Assist in the implementation and daily operation of technical controls to mitigate third-party security risks.
• Leverage automation and available tools to minimize manual effort and enhance consistency in repeatable processes.
• Collaborate with internal teams to comprehend intended vendor/tool usage and gather necessary security context.
• Maintain precise systems-of-record documentation, including artifacts, notes, decisions, and rationale, with meticulous attention to detail.
• Monitor recurring risk themes and basic metrics (e.g., cycle time, common findings, exceptions) to continuously improve team efficiency.
• Contribute to team knowledge by updating playbooks and sharing insights from completed reviews.

Qualifications

While experience in all areas is not expected, it would be beneficial if you possessed one or more of the following:

• Clear, approachable written communication skills, with the ability to explain technical details to non-technical stakeholders.
• A foundational understanding of security principles (risk concepts, controls, privacy/compliance basics).
• Exceptional attention to detail and a proven track record of producing accurate, audit-ready documentation.
• Capability to quickly resolve problems, ensure follow-through, and appropriately escalate unclear or high-risk situations.
• Experience adhering to structured processes/playbooks and proposing enhancements when inefficiencies or gaps are identified.
• Comfort working with various tools and systems (ticketing, documentation, spreadsheets) to manage tasks comprehensively.
• Familiarity with automation, scripting, or workflow tools, or a strong desire to learn and implement them.

Key skills/competency

• Vendor Security
• Risk Assessment
• Technical Controls
• Security Reviews
• Compliance
• Documentation
• Automation
• Problem Solving
• Cross-functional Collaboration
• Security Fundamentals