Third-Party Risk Analyst

🕒 August 11

🇺🇸 United States – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

🎲 Risk

👻 Ghost score 15%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

OpenRouter

WebsiteLinkedInAll Job Openings

1 - 10 employees

Founded 2023

💼 Consulting

📣 Marketing

🤖 Artificial Intelligence

Consulting • Marketing • Artificial Intelligence

OpenRouter is a platform providing a unified interface for interacting with various large language models (LLMs). It focuses on delivering better prices and uptime without the need for subscriptions. The platform supports multiple AI tasks and showcases models like Mistral Small 3 and DeepSeek R1 Distill Qwen 32B, which are designed for fast performance and high accuracy. OpenRouter also features gaming and coding tools that enhance usability across different sectors such as marketing, finance, and education.

📋 Description

• Own end-to-end security assessments for model providers, subprocessors, and SaaS tooling • Read and critically evaluate SOC 2 and ISO reports, including scope, carve-outs, CUECs, exceptions, testing, pen tests, DPAs, and subprocessor lists • Turn findings into residual-risk decisions and compensating controls • Design and establish the third-party risk management program, including intake, tiering, SLAs, escalation, exceptions, and risk acceptance • Evaluate and implement tooling integrated with the Drata GRC stack and ticketing system • Build continuous monitoring for critical vendors and run annual reviews • Map vendor risk to SOC 2, ISO 27001, HIPAA, GDPR, and EU AI Act obligations, including flow-down to subprocessors

🎯 Requirements

• 4+ years in third-party/vendor security risk or security assessment • Working fluency across SOC 2, ISO 27001, HIPAA, and GDPR • Sufficient command of the EU AI Act to reason about its application • Technical literacy in cloud architecture, access models, encryption, and data flows • Comfort with DPAs, BAAs, and security exhibits • Ability to pitch solutions and drive implementation independently • Clear writing and high tolerance for ambiguity • Nice to have: experience assessing AI/ML vendors or inference infrastructure • Nice to have: ISO 42001 or NIST AI RMF experience • Nice to have: scripting and automation experience • Nice to have: GRC platform administration, such as Drata or Vanta • Nice to have: early-stage startup experience building a function • Nice to have: CISSP, CISA, CRISC, or CTPRP certification