Security Review Expert - SOC 2

Mercor; San Francisco (CA); Hybrid; MXN 2,243,000 - 2,742,000; Part time

Job summary

Mercor is seeking a Security Expert for a contract role focused on third-party risk and security review. This remote position requires evaluating SOC 2 reports, security questionnaires, and other evidence to ensure alignment with buyers' standards.

You'll craft rubric-style feedback, assess data-handling and sub-processor risk, and work asynchronously to meet deadlines while contributing to AI model improvements.

Qualifications

• 8+ years in security review, vendor risk management, or TPRM.
• Hands-on experience with SOC 2 reports and security questionnaires.
• Strong written communication; ability to produce rubric-style feedback.

Responsibilities

• Review SOC 2 reports and security questionnaires against buyer standards.
• Identify scope mismatches and outdated bridge letters.
• Author step-level rubrics and golden responses for reviewer judgments.
• Assess data-handling and sub-processor risk for vendors.
• Work independently and asynchronously to meet deadlines; support AI model improvements.

Skills

SOC 2 review

Vendor risk management

Rubric writing

Written communication

Education

CISSP or CISA certification

Job description

About the job

Mercor connects elite creative and technical talent with leading AI research labs. Headquartered in San Francisco, our investors include Benchmark , General Catalyst , Peter Thiel , Adam D'Angelo , Larry Summers , and Jack Dorsey .

Position: Security Expert
Type: Contract
Compensation: $90–$110/hour
Location: Remote

Role Responsibilities

Review simulated vendor SOC 2 reports , security questionnaires, and pen-test evidence against a buyer's security standard. Catch scope mismatches and lapsed bridge letters that a surface-level review would miss. Author step-level rubrics and golden responses capturing how an experienced security reviewer would judge a request or renewal. Assess data-handling and sub-processor risk for vendors touching sensitive data. Work independently and asynchronously to meet deadlines while improving AI model performance .

Qualifications

Must-Have

• 8+ years of professional experience in security review, vendor risk management, or third-party risk (TPRM).
• Hands-on experience evaluating SOC 2 reports , security questionnaires, and compliance evidence.
• Strong written communication skills; comfortable producing structured, rubric-style feedback.

Preferred

• Relevant security certification, such as CISSP or CISA .
• Prior task-writing, rubric-authoring, or AI-training data experience.