Third-Party Risk Lead - AI SaaS Security & Compliance

Legora; New York (NY); On-site; USD 232,000 - 273,000; Full time

Benefits offered by this job

Parental leave

Free Maven Clinic access

Dependent Care FSA

Free One Medical membership

Pre‑tax commuter benefits

Life Insurance + STD/LTD

401(K) with company match

Unlimited PTO

Identity protection (via Aura)

Job summary

Legora builds AI software for legal work. Our products rely on cloud platforms, AI providers, and partners. You will lead our third-party risk program within Security, setting assessment standards and guiding complex reviews to ensure findings are resolved with owners.

This is a hands-on role that blends program leadership with practical risk assessment. You will report to engineering and work with procurement and legal on contracts, access, data sharing, and contingency planning.

Qualifications

• Experience building or substantially improving a third-party or technology risk program in a SaaS or cloud environment.
• Hands-on supplier assessment experience, including interpreting assurance reports, challenging unsupported claims, and writing clear recommendations.
• Enough technical depth to discuss data flows, permissions, integrations, and service dependencies with engineers.
• Evidence that you can get agreed mitigations completed across teams, including where you have no direct management authority.
• Experience improving assessment workflows through automation, with a clear approach to checking accuracy.
• Sound judgment when evidence is incomplete. You can explain the likely impact, available options, and what remains uncertain.
• Experience with AI-provider assessments, subprocessor governance, supplier resilience, or quantified risk analysis would be useful.

Responsibilities

• Assess suppliers in context. Understand the service being purchased, the information it will handle, the access it needs, and the consequences of failure. Set the depth of each review accordingly. Examine supplier evidence and investigate gaps with the relevant technical teams.
• Understand our critical dependencies. Maintain a view of critical providers, their key subcontractors, and dependencies shared across services. Identify where we depend heavily on one provider or would struggle to replace it.
• Turn findings into action. Recommend approval conditions and practical mitigations, including changes to access, data sharing, or how a service is used. Agree owners and deadlines, track completion, and elevate unresolved risks for an authorized decision.
• Prepare for supplier failure. Work with Engineering and service owners on contingency, recovery, and exit plans for critical providers. Check whether those plans have been tested and make remaining gaps visible.
• Manage risk throughout the relationship. Build reviews into onboarding, material service changes, renewals, and offboarding. Define when reassessment is needed and coordinate follow‑up after supplier incidents. Keep subprocessor information accurate and work with Legal on customer notification commitments.
• Improve how assessments run. Set clear review standards and check assessment quality. Use automation and AI where they improve evidence collection or follow‑up, with traceable sources and checks on their output.
• Give leadership a useful view of risk. Report assessment coverage, unresolved material findings, overdue actions, and the readiness of critical suppliers’ contingency plans. Explain the decisions needed and the consequences of delaying them.

Skills

Third-party risk program

Supplier assessment

Technical depth

Mitigations

Automation

Judgment under uncertainty

AI-provider assessments

Tools

GRC tools

Job description

Legora builds AI software for legal work. Our products rely on cloud platforms, AI providers, and partners. You will lead our third-party risk program within Security, setting assessment standards and guiding complex reviews to ensure findings are resolved with owners.

This is a hands-on role that blends program leadership with practical risk assessment. You will report to engineering and work with procurement and legal on contracts, access, data sharing, and contingency planning.