Third-Party Risk Management Analyst
About The Position
Fireworks is seeking a Third-Party Risk Management (TPRM) Analyst to evaluate, onboard, and monitor the vendors and subprocessors used by the company. The analyst will join the security and compliance team and run the vendor risk lifecycle, including intake, due diligence, risk tiering, contract security review, ongoing monitoring, remediation, and offboarding. The work supports Fireworks’ SOC 2, HIPAA, ISO 27001, ISO 27701, ISO 42001, and GDPR commitments and helps customers understand the security of the supply chain behind their data. The role involves conducting reviews of vendors ranging from cloud and GPU infrastructure providers to SaaS tools and AI/ML services. The analyst will collaborate with Engineering, IT, HR, Legal, Procurement, and GTM, explaining risk clearly and helping teams address findings. The position offers scope to grow into end-to-end ownership of the TPRM workstream, program design, and broader enterprise risk initiatives.
Requirements
- 3–5 years of experience in third-party/vendor risk management, GRC, IT audit, or information security.
- Hands-on experience conducting vendor security assessments, including reviewing questionnaires, SOC 2 and ISO reports, and security documentation and translating them into risk ratings.
- Familiarity with the TPRM lifecycle, including intake, risk tiering, exceptions and risk acceptance, remediation tracking, and periodic reassessment.
- Working knowledge of SOC 2, ISO 27001/27701/42001, HIPAA, GDPR, NIST CSF, or similar frameworks, as well as common control domains such as access control, encryption, incident response, and business continuity/disaster recovery.
- Experience with a GRC or TPRM platform such as Anecdotes, Vanta, Drata, Secureframe, OneTrust, Whistic, or similar.
- Comfort with AWS, GCP, or Azure environments and an understanding of how SaaS and AI products are built and operated, sufficient to assess vendors that host or process company data.
- Strong written communication skills and the ability to explain vendor risk to technical and non-technical stakeholders without overstating or hand-waving.
- Detail-oriented and organized, with the ability to manage multiple reviews and deadlines while maintaining rigor.
- Collaborative mindset and willingness to work across teams rather than act as a gatekeeper.
Responsibilities
- Triage vendor requests from Engineering, IT, GTM, and Legal; classify vendors by data sensitivity and criticality; and set review depth according to risk tier.
- Conduct security due diligence by reviewing SOC 2 Type II reports, ISO certificates, HIPAA and GDPR documentation, penetration test summaries, and security questionnaires, then assign clear, defensible risk ratings.
- Identify control gaps and compensating controls, document findings and exceptions, and drive risk-acceptance decisions with appropriate risk owners.
- Partner with Legal and Procurement on DPAs, BAAs, subprocessor terms, and security addenda so risk findings are addressed before contracts are signed.
- Monitor vendors through tiered reassessments, track SOC 2 and ISO report expirations and bridge letters, monitor vendor incidents and breaches, and review subprocessor changes.
- Track vendor remediation to closure, maintain the vendor inventory and risk register, and manage records in the GRC platform.
- Report on program health, including review cycle times, backlog, open exceptions, reassessment coverage, and concentration risk, and provide insights to security leadership.
- Improve questionnaires, tiering criteria, intake workflows, and templates; use automation and AI-assisted workflows to increase review capacity while maintaining rigor.
- Work across teams and explain vendor risk in plain language.
- As the role grows, own the TPRM workstream from intake through offboarding, including policy, standards, and tiering criteria.
- Help design assessment methods, risk models, and automation to improve speed and consistency as vendor volume grows.
- Connect third-party findings to the enterprise risk register and represent GRC in cross-functional projects, including AI/ML vendor adoption and infrastructure provider selection.
Benefits
- Opportunity to tackle challenges at the forefront of AI infrastructure.
- Opportunity to work with bleeding-edge technology affecting how businesses and developers use AI globally.
- Ownership and impact in a fast-growing team, with work that directly shapes the future of AI.
- Opportunity to collaborate with engineers and AI researchers.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
Education Level
No Education Listed
