Third-Party Risk Analyst

Job not on LinkedIn

🔥 0 minutes ago

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

OpenRouter

WebsiteLinkedInAll Job Openings

1 - 10 employees

Founded 2023

💼 Consulting

📣 Marketing

🤖 Artificial Intelligence

Consulting • Marketing • Artificial Intelligence

OpenRouter is a platform providing a unified interface for interacting with various large language models (LLMs). It focuses on delivering better prices and uptime without the need for subscriptions. The platform supports multiple AI tasks and showcases models like Mistral Small 3 and DeepSeek R1 Distill Qwen 32B, which are designed for fast performance and high accuracy. OpenRouter also features gaming and coding tools that enhance usability across different sectors such as marketing, finance, and education.

📋 Description

• Own end-to-end security assessments for model providers, subprocessors, and SaaS tooling • Read and critically evaluate SOC 2 and ISO reports, including scope, carve-outs, CUECs, exceptions, testing, pen tests, DPAs, and subprocessor lists • Turn findings into residual-risk decisions and compensating controls • Design and establish the third-party risk management program, including intake, tiering, SLAs, escalation, exceptions, and risk acceptance • Evaluate and implement tooling integrated with the Drata GRC stack and ticketing system • Build continuous monitoring for critical vendors and run annual reviews • Map vendor risk to SOC 2, ISO 27001, HIPAA, GDPR, and EU AI Act obligations, including flow-down to subprocessors

🎯 Requirements

• 4+ years in third-party/vendor security risk or security assessment • Working fluency across SOC 2, ISO 27001, HIPAA, and GDPR • Sufficient command of the EU AI Act to reason about its application • Technical literacy in cloud architecture, access models, encryption, and data flows • Comfort with DPAs, BAAs, and security exhibits • Ability to pitch solutions and drive implementation independently • Clear writing and high tolerance for ambiguity • Nice to have: experience assessing AI/ML vendors or inference infrastructure • Nice to have: ISO 42001 or NIST AI RMF experience • Nice to have: scripting and automation experience • Nice to have: GRC platform administration, such as Drata or Vanta • Nice to have: early-stage startup experience building a function • Nice to have: CISSP, CISA, CRISC, or CTPRP certification