[Hiring] Vendor Risk Specialist @Mercor

Role Description

• Review simulated vendor SOC 2 reports, security questionnaires, and pen-test evidence against a buyer's security standard.
• Catch scope mismatches and lapsed bridge letters that a surface-level review would miss.
• Author step-level rubrics and golden responses capturing how an experienced security reviewer would judge a request or renewal.
• Assess data-handling and sub-processor risk for vendors touching sensitive data.
• Work independently and asynchronously to meet deadlines while improving AI model performance.

Qualifications

• 8+ years of professional experience in security review, vendor risk management, or third-party risk (TPRM).
• Hands-on experience evaluating SOC 2 reports, security questionnaires, and compliance evidence.
• Strong written communication skills; comfortable producing structured, rubric-style feedback.
• Relevant security certification, such as CISSP or CISA (preferred).
• Prior task-writing, rubric-authoring, or AI-training data experience (preferred).

Company Description