Third-Party Risk Analyst
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Third-Party Risk Analyst building OpenRouter’s vendor security program for AI infrastructure. Assessing model providers and subprocessors against security, privacy, and AI regulations.
Responsibilities:
- Own end-to-end security assessments for model providers, subprocessors, and SaaS tooling
- Read and critically evaluate SOC 2 and ISO reports, including scope, carve-outs, CUECs, exceptions, testing, pen tests, DPAs, and subprocessor lists
- Turn findings into residual-risk decisions and compensating controls
- Design and establish the third-party risk management program, including intake, tiering, SLAs, escalation, exceptions, and risk acceptance
- Evaluate and implement tooling integrated with the Drata GRC stack and ticketing system
- Build continuous monitoring for critical vendors and run annual reviews
- Map vendor risk to SOC 2, ISO 27001, HIPAA, GDPR, and EU AI Act obligations, including flow-down to subprocessors
Requirements:
- 4+ years in third-party/vendor security risk or security assessment
- Working fluency across SOC 2, ISO 27001, HIPAA, and GDPR
- Sufficient command of the EU AI Act to reason about its application
- Technical literacy in cloud architecture, access models, encryption, and data flows
- Comfort with DPAs, BAAs, and security exhibits
- Ability to pitch solutions and drive implementation independently
- Clear writing and high tolerance for ambiguity
- Nice to have: experience assessing AI/ML vendors or inference infrastructure
- Nice to have: ISO 42001 or NIST AI RMF experience
- Nice to have: scripting and automation experience
- Nice to have: GRC platform administration, such as Drata or Vanta
- Nice to have: early-stage startup experience building a function
- Nice to have: CISSP, CISA, CRISC, or CTPRP certification
Similar Jobs
Coordinator, Governance and Network Engagement
WWF International governance coordinator supporting senior leadership meetings, strategic research, and executive presentations. Managing calendars, meeting packages, documents, travel, and network governance communications.
Head of Risk Operations
SentiLink fraud intelligence leader transforming identity-risk operations and prevention. Building scalable workflows, talent programs, metrics, and cross-functional fraud insights.
Manager, Risk Analytics
Risk Analytics Manager pricing insurance risk for Extend’s AI-powered post-purchase platform. Owning pricing methodology, risk strategy, data foundations, and team development.
Director Analyst, Privacy and Information Governance Expert
Gartner Director Analyst developing privacy and information governance research for enterprise leaders. Advising General Counsel and assurance teams on regulations, AI governance, and data strategy.
Director, Analyst – Privacy and Information Governance Expert
Gartner Director Analyst advising enterprise legal and assurance leaders on privacy, information governance, and AI governance. Producing research, insights, and actionable client recommendations.
Manager, Model Risk and Governance
Model risk manager governing fraud-detection models for SentiLink, an identity verification company. Leading governance strategy, customer relationships, regulatory validation, and a growing risk team.
Medical Retrieval and Risk Adjustment Consultant
Medical records retrieval consultant supporting risk adjustment, HEDIS, and RADV audits for Med Cap Health’s U.S. healthcare network. Coordinating documentation, portal submissions, compliance tracking, and issue resolution.
Risk Control Consultant – Equipment Breakdown
Risk Control Consultant evaluating complex equipment-breakdown risks for CNA, an insurance company. Delivering risk recommendations, underwriting support, training, and broker relationship management.
Risk & Trading Associate
Risk and Trading Associate supporting PENN Entertainment’s online sportsbook and sports betting products. Monitoring prices, liabilities, promotions, suspicious activity, and player risk in real time.
Risk & Trading Associate
Risk and Trading Associate supporting Penn Interactive’s online sportsbook operations, pricing, promotions, and player-risk monitoring. Monitoring betting activity and assisting traders across 24/7 North American sports markets.
Risk Quality Specialist
Risk Quality Specialist at Allstate Insurance Company of Canada conducting audits of call interactions and customer files to ensure compliance and quality standards. Contributing insights to improve performance and governance in insurance operations.
Risk Control Specialist
Risk Control Specialist conducting evaluations for niche-market policyholders and providing expert consultation across all lines of coverage. Collaborating with internal departments and delivering advanced training to team members.
Lead Coder – Risk Management
Coder Lead overseeing coding compliance in Risk Management for Advocate Health. Training and directing coding team, ensuring quality standards are met with ICD, CPT, and HCPCS.
Senior Risk Advisory Manager – Insurance
Senior Manager (Insurance) leading complex client engagements at Cherry Bekaert. Overseeing risk management and compliance for insurance organizations in a remote role.
Officer, Shareholder Strategy – Corporate Governance
Coordinator for PETA’s shareholder work in corporate responsibility and advocacy across various sectors. Engage with corporations to advance animal rights initiatives and secure investments.
Global Head of Brand Governance – Operations
Global Head of Brand Governance & Operations enabling brand management at GE Vernova. Collaborating with legal and business operations to ensure brand consistency and compliance.
Risk Control Specialist
Risk Control Specialist responsible for managing workers’ compensation risk management services. Engaging with clients through inspections, training programs, and safety committees.
Head of Risk – Executive Director
Head of Risk & Executive Director Legal at RedotPay developing risk management frameworks and overseeing risk controls in Nigeria. Contributing to Board-level risk oversight and strategic decision-making in fintech.
Risk & Issue Manager – Federal Health
Risk & Issue Manager overseeing risk management for a federal healthcare modernization initiative. Collaborating with cross-functional teams to ensure project delivery and mitigate risks.
Principal Cyber Governance & Risk Advisor, Senior Associate
Cyber Governance and Risk Advisor at Intelance advising complex organizations on governance and risk management frameworks. Mentoring and collaborating with experienced specialists in advisory services.