Vendor Risk Analyst — AI Infra & Compliance

Fireworks; San Mateo (CA); On-site; USD 120,000 - 170,000; Full time

Job summary

Fireworks is hiring a Third-Party Risk Management (TPRM) Analyst to own how we evaluate, onboard, and monitor the vendors and subprocessors we depend on. You’ll run the full risk lifecycle, supporting SOC 2, HIPAA, ISO 27001/27701/42001, and GDPR commitments to give customers confidence in our supply chain.

From day one you’ll conduct vendor reviews across cloud and SaaS providers, collaborate with Legal and Procurement on DPAs and subprocessor terms, and drive remediation.

Qualifications

• 3–5 years of experience in third‑party/vendor risk management, GRC, IT audit, or information security.
• Hands‑on vendor security assessments: reviewing SOC 2 and ISO reports and security documentation.
• Familiarity with the TPRM lifecycle: intake, tiering, exceptions, remediation tracking, and reassessment.
• Experience with a GRC or TPRM platform such as Vanta, Drata, Secureframe, OneTrust, or Whistic.

Responsibilities

• Run vendor intake and risk tiering.
• Perform security due diligence.
• Spot real gaps.
• Partner on contracts.
• Monitor vendors continuously.
• Track remediation to closure.
• Report on program health.
• Improve the program.
• Work across teams.

Skills

Vendor risk management

GRC

IT audit

Information security

Tools

Vanta

Drata

Secureframe

OneTrust

Whistic

Job description

Fireworks is hiring a Third-Party Risk Management (TPRM) Analyst to own how we evaluate, onboard, and monitor the vendors and subprocessors we depend on. You’ll run the full risk lifecycle, supporting SOC 2, HIPAA, ISO 27001/27701/42001, and GDPR commitments to give customers confidence in our supply chain.

From day one you’ll conduct vendor reviews across cloud and SaaS providers, collaborate with Legal and Procurement on DPAs and subprocessor terms, and drive remediation.