Third-Party Risk Management Analyst

Fireworks AI

. Run vendor intake and risk tiering for vendors requested by Engineering, IT, GTM, and Legal .

Posted 11/7/2026full-timeUnited StatesMid-LevelSenior💰 $150,000 - $170,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in third-party/vendor risk management, including vendor security assessments, risk tiering, and remediation tracking. Proficient in utilizing GRC platforms and frameworks such as SOC 2, ISO, HIPAA, and GDPR to communicate and manage vendor risk effectively.

Highest-signal resume keywords

Third-Party Risk Management (TPRM)Vendor Security AssessmentsGRC Platform ExperienceSOC 2 ComplianceISO 27001 Knowledge

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Vendor Risk ManagementRisk TieringSecurity Due DiligenceControl Gap AnalysisRemediation TrackingRisk Acceptance DecisionsSecurity Documentation ReviewIncident ResponseBC/DR KnowledgeData Protection Agreements (DPAs)

Soft Skills

Strong Written CommunicationDetail-OrientedOrganizational SkillsCollaboration

Tools & Technologies

GRC PlatformsAnecdotesVantaDrataSecureframeOneTrustWhisticAWSGCPAzure

Industry Keywords

SOC 2 Type IIISO CertificatesHIPAAGDPRNIST CSFSecurity QuestionnairesPenetration TestingRisk RegisterSubprocessor TermsAutomation

Tech Stack

Tools & technologies

AWSAzureGoogle Cloud Platform

About the role

Key responsibilities & impact

Run vendor intake and risk tiering for vendors requested by Engineering, IT, GTM, and Legal
Perform security due diligence by reviewing SOC 2 Type II reports, ISO certificates, HIPAA and GDPR documentation, penetration test summaries, and security questionnaires
Distinguish true control gaps from acceptable compensating controls, document findings and exceptions, and drive risk acceptance decisions
Partner with Legal and Procurement on DPAs, BAAs, subprocessor terms, and security addenda
Monitor vendors through reassessments, report-expiration tracking, bridge-letter reviews, incident and breach monitoring, and subprocessor-change reviews
Track remediation to closure and maintain the vendor inventory and risk register in the GRC platform
Report on review cycle times, backlog, exceptions, reassessment coverage, and concentration risk to security leadership
Improve questionnaires, tiering criteria, intake workflows, templates, and automation/AI-assisted review workflows
Collaborate with Engineering, IT, HR, Legal, and GTM to communicate vendor risk
Progress toward end-to-end TPRM ownership, program design, risk-model development, automation, and enterprise-risk integration

Requirements

What you’ll need

3-5 years of experience in third-party/vendor risk management, GRC, IT audit, or information security
Hands-on experience running vendor security assessments and translating questionnaires, SOC 2 and ISO reports, and security documentation into risk ratings
Familiarity with the TPRM lifecycle, including intake, risk tiering, exceptions and risk acceptance, remediation tracking, and periodic reassessment
Working knowledge of SOC 2, ISO 27001/27701/42001, HIPAA, GDPR, NIST CSF, or similar frameworks
Knowledge of common control domains, including access control, encryption, incident response, and BC/DR
Experience with a GRC or TPRM platform such as Anecdotes, Vanta, Drata, Secureframe, OneTrust, Whistic, or similar
Comfort with AWS, GCP, or Azure environments and SaaS and AI product operations
Strong written communication skills for explaining vendor risk to technical and non-technical stakeholders
Detail-oriented and organized, with the ability to manage multiple reviews and deadlines
Ability to collaborate across teams

Benefits

Comp & perks

Equity
Opportunity to grow into owning the TPRM program end to end
Exposure to cutting-edge AI infrastructure and model serving technology
Collaboration with world-class engineers and AI researchers
Equal-opportunity and inclusive work environment