Third-Party Risk Management Analyst

Highlights

• Own the full vendor risk lifecycle from intake and tiering to offboarding.
• Review cloud, GPU, SaaS and AI/ML vendors supporting production AI.
• Use automation and AI-assisted workflows to scale reviews without lowering the bar.

What they offer

• Equity

Ideal candidate

Collaborative, detail-oriented GRC professional with a few years in vendor risk who loves translating control gaps into plain language and shaping how a fast-moving AI company scales trust.

Requirements

• 3-5 years of experience in third-party/vendor risk management, GRC, IT audit, or information security
• Hands-on experience running vendor security assessments and translating findings into a clear risk rating
• Familiarity with the TPRM lifecycle: intake, risk tiering, exceptions, remediation tracking and reassessment
• Working knowledge of SOC 2, ISO 27001/27701/42001, HIPAA, GDPR, NIST CSF and common control domains
• Experience with a GRC or TPRM platform such as Vanta, Drata, OneTrust, Whistic or similar
• Comfort with cloud environments and how SaaS and AI products are built and operated
• Strong written communication and ability to explain vendor risk in plain language
• Detail-oriented and organized, able to juggle many reviews and deadlines without dropping rigor