Third-Party Risk Management Analyst

Fireworks • San Mateo, CA

2d • $150,000 - $170,000

About The Position

Fireworks is hiring a Third-Party Risk Management (TPRM) Analyst to evaluate, onboard, and monitor the vendors and subprocessors the company depends on. The role is part of the security and compliance team and manages the vendor risk lifecycle, including intake, due diligence, risk tiering, contract security review, ongoing monitoring, remediation, and offboarding. The work supports Fireworks’ SOC 2, HIPAA, ISO 27001, ISO 27701, ISO 42001, and GDPR commitments and helps provide customers with confidence in the supply chain behind their data.

The analyst will conduct vendor reviews across cloud and GPU infrastructure providers, SaaS tools, and AI/ML services, with opportunities to grow into end-to-end program ownership. As the role develops, the analyst may take ownership of the TPRM workstream and its policies, standards, and tiering criteria; help design assessment methods, risk models, and automation; and connect third-party findings to enterprise risk and cross-functional AI/ML and infrastructure decisions.

Requirements

• 3–5 years of experience in third-party/vendor risk management, GRC, IT audit, or information security.
• Hands-on experience conducting vendor security assessments, including reviewing questionnaires, SOC 2 and ISO reports, and security documentation and translating findings into a clear risk rating.
• Familiarity with the TPRM lifecycle, including intake, risk tiering, exceptions and risk acceptance, remediation tracking, and periodic reassessment.
• Working knowledge of SOC 2, ISO 27001/27701/42001, HIPAA, GDPR, NIST CSF, or similar frameworks, and common control domains such as access control, encryption, incident response, and business continuity/disaster recovery.
• Experience with a GRC or TPRM platform such as Anecdotes, Vanta, Drata, Secureframe, OneTrust, Whistic, or similar.
• Comfort with AWS, GCP, or Azure environments and an understanding of how SaaS and AI products are built and operated, sufficient to assess vendors that host or process company data.
• Strong written communication skills, including the ability to explain vendor risk to technical and non-technical stakeholders without overstating or hand-waving.
• Detail-oriented and organized, with the ability to manage multiple reviews and deadlines while maintaining rigor.
• Collaborative mindset and willingness to work across teams rather than act as a gatekeeper.

Responsibilities

• Triage vendor requests from Engineering, IT, GTM, and Legal; classify vendors by data sensitivity and criticality; and scale review depth according to risk tier.
• Review SOC 2 Type II reports, ISO 27001/27701/42001 certificates, HIPAA and GDPR documentation, penetration test summaries, and security questionnaires, and produce clear risk ratings.
• Identify control gaps and acceptable compensating controls, document findings and exceptions, and drive risk-acceptance decisions with appropriate risk owners.
• Partner with Legal and Procurement on DPAs, BAAs, subprocessor terms, and security addenda so risk findings are addressed before contracts are signed.
• Conduct tiered vendor reassessments; track SOC 2 and ISO report expirations and bridge letters; monitor vendor incidents and breaches; and review subprocessor changes.
• Track remediation with vendors and internal owners, maintain the vendor inventory and risk register in the GRC platform, and follow issues through closure.
• Report on review cycle times, backlog, open exceptions, reassessment coverage, and concentration risk, and provide insights to security leadership.
• Improve questionnaires, tiering criteria, intake workflows, and templates, and use automation and AI-assisted workflows to increase review capacity without lowering standards.
• Work with Engineering, IT, HR, Legal, and GTM, explaining vendor risk in plain language.
• As scope grows, own the TPRM workstream from intake through offboarding, including policy, standards, and tiering criteria.
• Help design assessment methods, risk models, and automation as vendor volume grows.
• Connect third-party findings to the enterprise risk register and represent GRC in cross-functional projects, including AI/ML vendor adoption and infrastructure provider selection.

Benefits

• Opportunity to work on challenges in AI infrastructure, including low-latency inference and scalable model serving.
• Opportunity to work with emerging technology used by businesses and developers globally.
• Ownership and direct impact on the company's work in a fast-growing team.
• Opportunity to collaborate with engineers and AI researchers.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed