Third-Party Risk Management Lead

Legora; New York (NY); On-site; USD 140,000 - 220,000; Full time

Benefits offered by this job

Company lunch daily

Unlimited PTO

401(K) with generous company match

Life Insurance + STD/LTD

Job summary

Legora in New York City is seeking an experienced leader to own and evolve the third-party risk program within Security. You will set assessment standards, run complex reviews, and drive findings to accountable owners in a hands-on role.

This on-site, five-days-a-week position collaborates with Engineering, Procurement, and Legal to align risk with business needs and customer commitments. You will balance thorough due diligence with practical mitigations and timely decisions.

Qualifications

• Experience building or substantially improving a third-party or technology risk program in a SaaS or cloud environment.
• Hands-on supplier assessment experience, including interpreting assurance reports, challenging unsupported claims, and writing clear recommendations.
• Enough technical depth to discuss data flows, permissions, integrations, and service dependencies with engineers.
• Evidence that you can get agreed mitigations completed across teams, including where you have no direct management authority.
• Experience improving assessment workflows through automation, with a clear approach to checking accuracy.
• Sound judgment when evidence is incomplete. You can explain the likely impact, available options, and what remains uncertain.

Responsibilities

• Assess suppliers in context. Understand the service being purchased, the information it will handle, the access it needs, and the consequences of failure. Set the depth of each review accordingly.
• Understand our critical dependencies. Maintain a view of critical providers, their key subcontractors, and dependencies shared across services.
• Turn findings into action. Recommend approval conditions and mitigations, including changes to access or data sharing, with owners and deadlines.
• Prepare for supplier failure. Work on contingency, recovery, and exit plans for critical providers.
• Manage risk throughout the relationship. Define onboarding reviews, renewals, offboarding, and reassessment timing.
• Improve assessments with automation and AI, ensuring traceable sources and checks.
• Provide leadership with risk views: coverage, unresolved findings, overdue actions, contingency readiness.

Skills

Third-party risk leadership

Supplier assessment

Data flows & integrations

Automation in assessments

Cross-team mitigation

AI-provider risk

Job description

PLEASE NOTE: This role is 5 days/week on-site in our NYC (Manhattan) office

About Us

Legora is redefining how legal work gets done. Not built for lawyers, built with them. We work alongside the world’s best legal teams, who expect excellence, precision, and speed, and we hold ourselves to the same bar.

Our AI-native workspace lets legal professionals move faster, think more clearly, and operate with sharper precision. By analysing thousands of documents in minutes and powering end-to-end workflows, we cut through complexity, teams can focus on what matters: judgment, strategy, and outcomes.

2,100+ customers across 80+ countries trust us, including Cleary Gottlieb, Goodwin, Linklaters, White & Case, Dentons, and Barclays. We’ve scaled to $200M+ in ARR, with teams across Europe, North America and APAC, and continue to expand through acquisitions including Qura, Walter AI, Graceview, Cadastral, and Wexler.

We partner with world-class performers: including Aaron Judge and the New York Yankees, Ludvig Åberg (and his caddie), and campaigns featuring Jude Law.

Joining Legora means three things.

• We lean in: ownership over titles, outcomes over intentions.
• We fight for excellence: high standards, direct, ego-free feedback.
• We grow together: as a team and with our customers.

Mission before ego. Everyone contributes. No one coasts.

If you’re driven by impact, pace, and raising the bar. This is the place.

About The Role

Legora builds AI software for legal work. Our products and operations depend on cloud platforms, AI model providers, software vendors, and other service partners. We need to understand which dependencies could disrupt our service or put information at risk, and act on that understanding.

You will lead our third-party risk program within Security. You will set assessment standards, lead complex reviews, and make sure significant findings reach a decision and an accountable owner. The role combines program leadership with hands‑on assessment work.

What you will do

• Assess suppliers in context. Understand the service being purchased, the information it will handle, the access it needs, and the consequences of failure. Set the depth of each review accordingly. Examine supplier evidence and investigate gaps with the relevant technical teams.
• Understand our critical dependencies. Maintain a view of critical providers, their key subcontractors, and dependencies shared across services. Identify where we depend heavily on one provider or would struggle to replace it.
• Turn findings into action. Recommend approval conditions and practical mitigations, including changes to access, data sharing, or how a service is used. Agree owners and deadlines, track completion, and elevate unresolved risks for an authorized decision.
• Prepare for supplier failure. Work with Engineering and service owners on contingency, recovery, and exit plans for critical providers. Check whether those plans have been tested and make remaining gaps visible.
• Manage risk throughout the relationship. Build reviews into onboarding, material service changes, renewals, and offboarding. Define when reassessment is needed and coordinate follow-up after supplier incidents. Keep subprocessor information accurate and work with Legal on customer notification commitments.
• Improve how assessments run. Set clear review standards and check assessment quality. Use automation and AI where they improve evidence collection or follow-up, with traceable sources and checks on their output.
• Give leadership a useful view of risk. Report assessment coverage, unresolved material findings, overdue actions, and the readiness of critical suppliers’ contingency plans. Explain the decisions needed and the consequences of delaying them.

You own the risk assessment and oversight process. Business owners remain responsible for their supplier relationships and authorized risk acceptance. You will work with Engineering on technical changes and with Procurement and Legal on commercial and contractual requirements.

What you will bring

• Experience building or substantially improving a third-party or technology risk program in a SaaS or cloud environment.
• Hands‑on supplier assessment experience, including interpreting assurance reports, challenging unsupported claims, and writing clear recommendations.
• Enough technical depth to discuss data flows, permissions, integrations, and service dependencies with engineers.
• Evidence that you can get agreed mitigations completed across teams, including where you have no direct management authority.
• Experience improving assessment workflows through automation, with a clear approach to checking accuracy.
• Sound judgment when evidence is incomplete. You can explain the likely impact, available options, and what remains uncertain.

Experience with AI-provider assessments, subprocessor governance, supplier resilience, or quantified risk analysis would be useful.

What’s In It For You

• Global collaboration: Partner with teams and clients across Europe, APAC, and North America.
• Competitive package: Comprehensive salary, benefits, and tools for success.
• Meaningful work: Your efforts shape how thousands of lawyers use AI daily.
• In-person environment: Union Square office designed for ambitious builders and company provided lunch daily.

We invest in our people with a comprehensive, thoughtfully designed benefits package:

• Multiple medical plan options through Aetna and Kaiser Permanente
• HSA or Healthcare FSA (based on plan selection)

Family Support

• Generous parental leave
• Free access to Maven Clinic
• Dependent Care FSA
• Free One Medical membership for employees and dependents
• Life Insurance + STD/LTD
• 401(K) with generous company match
• Unlimited PTO
• Robust voluntary benefits, including identity protection (via Aura), legal coverage via MetLife, pet savings programs, and more

Legora is an Equal Opportunity Employer

At Legora, we believe great teams are built on diversity of thought and experience. We’re proud to be an equal opportunity employer and committed to creating an inclusive, high-performance culture where everyone can do their best work. We welcome people of all backgrounds and don’t discriminate based on race, color, religion, national origin, gender, gender identity or expression, sexual orientation, age, disability, veteran status, or any other characteristic protected by law.