Vendor Supply Chain Analyst

Oneleet•Beaverton, OR

17d•$60,000 - $80,000•Remote

About The Position

Oneleet is hiring a Vendor Supply Chain Analyst to build and maintain its shared vendor security research library. The analyst verifies AI-generated research by checking findings against saved sources, resolving evidence gaps, and ensuring conclusions are supported. Engineering owns the AI research pipeline, while this role provides feedback to improve the accuracy and usefulness of its output. The role focuses on the reliability of shared vendor research and security posture scores; customer-specific risk scores are calculated separately based on each customer's exposure to a vendor. Preliminary research appears immediately, followed by human verification targeted within 1–2 days. The pipeline re-researches vendors every 90 days and routes significant changes for human review. The analyst will help process an initial backlog of approximately 500–600 vendors, prioritizing vendors used by the most customers, and help establish research-accuracy measures and compare computed scores with existing customer-assigned ratings. This is an opportunity to shape how Oneleet evaluates vendor security at scale by maintaining traceable evidence, improving review practices, and working with engineering to enhance the research pipeline. Oneleet is a remote-first company that hires globally where it can legally engage employees directly or through an employer-of-record partner.

Requirements

Hands-on experience conducting vendor security due diligence or third-party security assessments.
Strong research skills and judgment to distinguish evidence from marketing claims.
Familiarity with SaaS security practices and public security, privacy, and compliance documentation.
Analytical mindset and comfort investigating discrepancies, documenting uncertainty, and assessing whether scores reflect the underlying evidence.
Clear written communication and careful documentation habits.
Self-starter mindset; takes initiative, adapts quickly, thrives in ambiguity, and enjoys building processes from scratch.

Nice To Haves

Experience evaluating AI-generated research or designing human review processes.
Experience measuring research accuracy, calibrating scoring systems, or building quality assurance processes.
Background in third-party risk, compliance, or security research.
Experience helping an early-stage startup grow from Seed to Series A or beyond.
Scripting or automation skills that help analyze results or make verification more efficient.

Responsibilities

Verify AI-generated vendor research against saved sources, prioritizing vendors used by the most customers.
Correct unsupported claims and distinguish confirmed findings from missing or inconclusive evidence.
Research new SaaS vendors, resolve incomplete records, and review significant changes flagged by the pipeline, including breaches and changes to security practices.
Resolve source-access gaps by finding accessible sources or manually uploading available documents.
Verify public security claims, including SSO availability, published DPAs, subprocessor lists, and the existence of SOC 2 reports.
Evaluate research accuracy and compare computed scores with customer-assigned ratings; investigate differences and recommend evidence-based adjustments.
Document recurring errors, missed evidence, and ambiguous results, and provide actionable feedback to engineering to improve the AI pipeline.
Identify gaps or unclear definitions in evaluation criteria and propose updates as vendor practices and security expectations evolve.
Maintain traceable findings with saved sources, clear reasoning, and research dates so customers and auditors can understand the basis for findings.
Develop repeatable verification runbooks and escalation paths to support consistent decisions.