Third-Party Risk Analyst
Core
Building the vendor risk function from scratch to assess model providers and subprocessors in an AI routing layer, ensuring compliance with evolving regulations like the EU AI Act.
Role type
Founding Third-Party Risk Analyst (Security)
Builds
End-to-end security assessments, TPRM program, and continuous monitoring for critical vendors.
Domain
AI Infrastructure / Third-Party Risk Management / Regulatory Compliance
Deliverable
production ML models | product features | dashboards & analysis | research | client delivery | infrastructure | physical/clinical work
Required skills
Third-party/vendor security risk assessment, SOC 2 report analysis, ISO 27001 compliance, GDPR compliance, HIPAA compliance, EU AI Act interpretation, cloud architecture literacy, DPA/BAA negotiation, risk acceptance decision-making, GRC tool implementation.
Preferred skills
AI/ML vendor assessment, ISO 42001 knowledge, NIST AI RMF, automation scripting, GRC platform administration (Drata, Vanta), early-stage startup experience.
Technologies
Drata, SOC 2, ISO 27001, HIPAA, GDPR, EU AI Act, GRC stacks.
Responsibilities
Own end-to-end security assessments for model providers and subprocessors; critically read SOC 2 and ISO reports; design and stand up the TPRM program; map vendor risk to regulatory obligations; build continuous monitoring for critical vendors.
Seniority
Individual Contributor, Founding/Building from scratch
