Vendor Security Reviewer for AI Vendors (Remote, Contract)

mercor; México; À distance; MXN 2 275 000 - 2 781 000; Plein temps

Résumé du poste

Mercor is seeking a Security Expert for a contract role, working remotely. The ideal candidate will review SOC 2 reports and security questionnaires, assess vendor risk, and author rubrics to guide expert judgment. Strong written communication and 8+ years in security review are required.

Remote work enables asynchronous collaboration on risk assessments, with priority on data security and AI model performance. CISSP/CISA is preferred, and prior experience in AI training data is a plus.

Qualifications

• 8+ years of professional experience in security review, vendor risk management, or third-party risk (TPRM).
• Hands-on experience evaluating SOC 2 reports, security questionnaires, and compliance evidence.
• Strong written communication skills; comfortable producing structured, rubric-style feedback.
• Preferred CISSP or CISA certification, or equivalent.
• Experience with task-writing, rubric-authoring, or AI-training data is a plus.

Responsabilités

• Review simulated vendor SOC 2 reports, security questionnaires, and pen-test evidence against a buyer's security standard.
• Catch scope mismatches and lapsed bridge letters that a surface-level review would miss.
• Author step-level rubrics and golden responses capturing how an experienced security reviewer would judge a request or renewal.
• Assess data-handling and sub-processor risk for vendors touching sensitive data.
• Work independently and asynchronously to meet deadlines while improving AI model performance.

Connaissances

Security review

Vendor risk mgmt

TPRM

Strong written comms

Formation

CISSP or CISA certification

Description du poste

Mercor is seeking a Security Expert for a contract role, working remotely. The ideal candidate will review SOC 2 reports and security questionnaires, assess vendor risk, and author rubrics to guide expert judgment. Strong written communication and 8+ years in security review are required.

Remote work enables asynchronous collaboration on risk assessments, with priority on data security and AI model performance. CISSP/CISA is preferred, and prior experience in AI training data is a plus.