Third Party Risk Management and Customer Trust Lead
About The Position
Replit’s ecosystem is powered by an expanding array of external services and essential AI model partners. As our lead for Security Vendor Risk & Contract Reviews, you will architect and execute a risk management program focused on substantive evaluation rather than just processing checklists. You’ll analyze SOC 2 documentation, security assessments, and system architectures to determine actual risk profiles, collaborating with our Legal team to secure necessary contractual protections. This role reports to the Head of Security GRC and involves high-impact partnerships across Legal, Engineering, and Product teams.
Requirements
- 8+ years in third-party/vendor risk management, security risk, or a related GRC role
- Demonstrated ability to independently assess vendor risk rather than relying on questionnaire responses alone, fluent in reading SOC 2 reports, ISO certificates, pen test summaries, and architecture documentation
- Experience reviewing or redlining security and data-handling contract language, ideally in partnership with a legal team
- Working knowledge of data privacy fundamentals (GDPR, CCPA) as they relate to vendor and subprocessor relationships
- Strong cross-functional collaboration skills — this role touches Legal, Engineering, Product, and Sales regularly
- Experience building repeatable, scalable vendor review processes rather than inheriting an existing one
Nice To Haves
- Direct experience assessing foundation model providers or AI/ML vendors specifically
- Experience automating or streamlining third-party review workflows (e.g., continuous vendor monitoring, automated evidence pulls) is a plus
- Familiarity with NIST AI RMF, ISO 42001, or the EU AI Act
- Background at an AI-native product company or an LLM/model provider
- Paralegal experience or formal contract review training
- Relevant certifications (CTPRP, CISSP, CIPP/E)
Responsibilities
- Run substantive third-party risk management (TPRM), independently evaluating real risk, not just processing questionnaire responses
- Review SOC 2 reports, pen test findings, and architecture documentation to form an independent view of vendor risk, extending the same rigor to AI/model providers
- Partner with Legal on vendor and AI contract terms, including DPAs, subprocessor agreements, and AI-specific provisions
- Review contracts for non-standard security language when flagged by Legal or deal desk, and recommend redlines
- Maintain the vendor and AI/model risk register, feeding findings into the company's master risk register
- Enable sales through maturing the customer trust program
- Build the capability for continuous monitoring of vendor ecosystem
Benefits
- Competitive Salary & Equity
- 401(k) Program with a 4% match (US Only)
- Health, Dental, Vision and Life Insurance
- Short Term and Long Term Disability
- Paid Parental, Medical, Caregiver Leave
- Flexible Time Off (FTO) + Holidays
- Commuter Benefits (In-Office Only)
- Monthly Wellness Stipend
- Autonomous Work Environment
- In Office Set-Up Reimbursement (In-Office Only)
- Quarterly Team Gatherings
- In Office Amenities (In-Office Only)
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
