Remote Contract: Vendor Risk Reviewer & Rubric Architect

Mercor; San Francisco (CA); Hybrid; MXN 2,243,000 - 2,742,000; Part time

Job summary

Mercor is seeking a Security Expert for a contract role to review vendor security evidence and help strengthen AI training data workflows. The role centers on evaluating third-party risk for AI engagements and ensuring alignment with buyer security standards.

This remote position offers exposure to leading labs and fast-moving projects in security assessment. You will review SOC 2 reports, security questionnaires, and pen-test evidence, write rubric-based feedback, and develop step-by-step

Qualifications

• 8+ years of professional experience in security review, vendor risk management, or third-party risk (TPRM).
• Hands-on experience evaluating SOC 2 reports, security questionnaires, and compliance evidence.
• Strong written communication skills; comfortable producing structured, rubric-style feedback.

Responsibilities

• Review simulated vendor SOC 2 reports, security questionnaires, and pen-test evidence against a buyer's security standard.
• Catch scope mismatches and lapsed bridge letters that a surface-level review would miss.
• Author step-level rubrics and golden responses capturing how an experienced security reviewer would judge a request or renewal.
• Assess data-handling and sub-processor risk for vendors touching sensitive data.
• Work independently and asynchronously to meet deadlines while improving AI model performance.

Skills

Security review

Vendor risk management

Third-party risk

SOC 2

Job description

Mercor is seeking a Security Expert for a contract role to review vendor security evidence and help strengthen AI training data workflows. The role centers on evaluating third-party risk for AI engagements and ensuring alignment with buyer security standards.

This remote position offers exposure to leading labs and fast-moving projects in security assessment. You will review SOC 2 reports, security questionnaires, and pen-test evidence, write rubric-based feedback, and develop step-by-step