Supplier Security and Assurance Security GRC

Skills

About the Role

You will run supplier security assessments from evidence review through residual-risk decisions and remediation. You will manage supplier findings, monitor vendors after approval, assess SaaS configuration and security contracts, tune an LLM-backed assessment platform, and report supplier-security risk metrics.

Requirements

• Experience running end-to-end supplier security assessments at a technology company
• Knowledge of inherent risk, residual risk, control effectiveness, compensating controls, and risk acceptance
• Experience driving risk treatment to closure
• Experience building or tuning LLM-backed risk, compliance, or operations workflows
• Experience operating issue-management workflows
• Knowledge of SaaS security configuration, including SSO and SCIM
• Knowledge of vendor security contract terms, including DPAs and audit rights
• Ability to assess SOC 2 reports and penetration tests
• Bachelor’s degree or equivalent education, training, or experience

Responsibilities

• Run end-to-end supplier security assessments
• Review vendor controls and evidence and determine residual risk
• Route specialized findings to domain reviewers
• Document findings, owners, due dates, and risk acceptances
• Drive vendor remediation and escalate stalled risk treatment
• Run continuous monitoring and reassessments
• Investigate configuration, data, and use-case drift
• Improve assessment coverage, questionnaires, requirements, and tooling
• Tune the Claude-powered assessment platform
• Contribute to KPI and KRI reporting

Benefits

• Visa sponsorship
• Equity donation matching
• Generous vacation
• Parental leave
• Flexible working hours