Third-Party Risk Management Analyst

The role

The Third-Party Risk Management Analyst will own the evaluation, onboarding, and monitoring of vendors and subprocessors. This role involves running the full vendor risk lifecycle to support security and compliance commitments.

What you will do

• Run vendor intake and risk tiering
• Perform security due diligence by reviewing reports and questionnaires
• Identify control gaps and drive risk acceptance decisions
• Partner with Legal and Procurement on contracts and security addenda
• Monitor vendors continuously through reassessments and incident tracking
• Track remediation to closure and maintain a vendor inventory
• Report on program health and provide insights to security leadership
• Improve the program through refined workflows and automation
• Work across Engineering, IT, HR, Legal, and GTM teams

Required qualifications

• 3-5 years of experience in third-party/vendor risk management, GRC, IT audit, or information security
• Hands-on experience running vendor security assessments
• Familiarity with the TPRM lifecycle
• Working knowledge of SOC 2, ISO 27001/27701/42001, HIPAA, GDPR, NIST CSF, or similar
• Experience with a GRC or TPRM platform (Anecdotes, Vanta, Drata, Secureframe, OneTrust, Whistic, or similar)
• Comfort with cloud environments (AWS, GCP, or Azure)
• Strong written communication
• Detail-oriented and organized

Benefits

• Solve Hard Problems
• Build What’s Next
• Ownership & Impact
• Learn from the Best

About the company

Fireworks is a Series D company and platform for specialized intelligence that enables companies to build, train, and serve AI models. The company is backed by several investors including NVIDIA and Sequoia Capital.