Vendor Risk Specialist - Fully Remote | Upto $110/hr

Mercor; San Francisco (CA); Hybrid; MXN 2,243,000 - 2,742,000; Part time

Job summary

Mercor is seeking a Security Expert for a contract role to review vendor security evidence and help strengthen AI training data workflows. The role centers on evaluating third-party risk for AI engagements and ensuring alignment with buyer security standards.

This remote position offers exposure to leading labs and fast-moving projects in security assessment. You will review SOC 2 reports, security questionnaires, and pen-test evidence, write rubric-based feedback, and develop step-by-step

Qualifications

• 8+ years of professional experience in security review, vendor risk management, or third-party risk (TPRM).
• Hands-on experience evaluating SOC 2 reports, security questionnaires, and compliance evidence.
• Strong written communication skills; comfortable producing structured, rubric-style feedback.

Responsibilities

• Review simulated vendor SOC 2 reports, security questionnaires, and pen-test evidence against a buyer's security standard.
• Catch scope mismatches and lapsed bridge letters that a surface-level review would miss.
• Author step-level rubrics and golden responses capturing how an experienced security reviewer would judge a request or renewal.
• Assess data-handling and sub-processor risk for vendors touching sensitive data.
• Work independently and asynchronously to meet deadlines while improving AI model performance.

Skills

Security review

Vendor risk management

Third-party risk

SOC 2

Job description

About the job

Mercor connects elite creative and technical talent with leading AI research labs. Headquartered in San Francisco, our investors include Benchmark , General Catalyst , Peter Thiel , Adam D'Angelo , Larry Summers , and Jack Dorsey .

Position: Security Expert
Type: Contract
Compensation: $90–$110/hour
Location: Remote

Role Responsibilities

Review simulated vendor SOC 2 reports , security questionnaires, and pen-test evidence against a buyer's security standard. Catch scope mismatches and lapsed bridge letters that a surface-level review would miss. Author step-level rubrics and golden responses capturing how an experienced security reviewer would judge a request or renewal. Assess data-handling and sub-processor risk for vendors touching sensitive data. Work independently and asynchronously to meet deadlines while improving AI model performance .

Qualifications

Must-Have

• 8+ years of professional experience in security review, vendor risk management, or third-party risk (TPRM).
• Hands-on experience evaluating SOC 2 reports , security questionnaires, and compliance evidence.
• Strong written communication skills; comfortable producing structured, rubric-style feedback.

Preferred

• Relevant security certification, such as CISSP or CISA .
• Prior task-writing, rubric-authoring, or AI-training data experience.