First Vendor Risk Analyst for AI Infrastructure

OpenRouter; New York (NY); On-site; USD 140,000 - 190,000; Full time

Job summary

OpenRouter is seeking its first security risk analyst to build the vendor risk function from scratch and accelerate risk reviews for model providers, subprocessors, and SaaS tooling.

You will own end-to-end assessments, read SOC 2 and ISO reports critically, and translate findings into concrete decisions with residual risk and compensating controls. You’ll design the TPRM program and drive tooling adoption across our GRC stack.

Qualifications

• 4+ years in third-party/vendor security risk or security assessment.
• Fluency across SOC 2, ISO 27001, HIPAA, and GDPR; able to reason about EU AI Act.
• Technical literacy in cloud architecture, access models, encryption, and data flows.
• Comfort with DPAs, BAAs, and security exhibits.
• Bias toward shipping; own and implement solutions.

Responsibilities

• Own end-to-end security assessments for model providers, subprocessors, and SaaS tooling.
• Critically read SOC 2 and ISO reports, tests, and subprocessor lists.
• Turn findings into decisions with residual risk and compensating controls.
• Design and stand up the TPRM program with intake, tiering, SLAs, and risk acceptance.
• Pitch and implement tooling integrated with the GRC stack (Drata) and ticketing.
• Build continuous monitoring for critical vendors and annual reviews.
• Map vendor risk to SOC 2, ISO 27001, HIPAA, GDPR, and EU AI Act obligations.

Skills

Vendor risk experience

SOC 2 / ISO 27001 knowledge

Technical literacy

Clear writing

Tools

Drata

Vanta

Job description

OpenRouter is seeking its first security risk analyst to build the vendor risk function from scratch and accelerate risk reviews for model providers, subprocessors, and SaaS tooling.

You will own end-to-end assessments, read SOC 2 and ISO reports critically, and translate findings into concrete decisions with residual risk and compensating controls. You’ll design the TPRM program and drive tooling adoption across our GRC stack.