Third-Party Risk Management Analyst (AI)

Location: Hybrid in San Mateo or New York, United States

Salary: $150K–$170K plus equity

Company

Fireworks AI provides an AI platform for building, training, and serving specialized models across text, image, embedding, audio, and multimodal workloads.

What you will do

• Run vendor intake, data-sensitivity and criticality-based risk tiering, and the full third-party risk lifecycle through offboarding.
• Perform security due diligence on cloud, GPU infrastructure, SaaS, and AI/ML vendors by reviewing questionnaires, SOC 2 Type II reports, ISO certifications, HIPAA and GDPR documentation, and penetration-test summaries.
• Identify control gaps and compensating controls, document findings and exceptions, and support risk acceptance decisions.
• Partner with Legal and Procurement on DPAs, BAAs, subprocessor terms, and security addenda.
• Monitor vendors through reassessments, report-expiration tracking, bridge-letter reviews, incident and breach monitoring, and subprocessor-change reviews.
• Track remediation, maintain the vendor inventory and risk register, report program metrics, and improve questionnaires, workflows, tiering criteria, templates, automation, and AI-assisted reviews.

Requirements

• 3–5 years of experience in third-party/vendor risk management, GRC, IT audit, or information security.
• Hands-on experience conducting vendor security assessments and converting questionnaires, SOC 2 and ISO reports, and security documentation into clear risk ratings.
• Familiarity with intake, risk tiering, exceptions, risk acceptance, remediation tracking, and periodic reassessment.
• Working knowledge of SOC 2, ISO 27001/27701/42001, HIPAA, GDPR, NIST CSF, or similar frameworks, plus access control, encryption, incident response, and business continuity/disaster recovery.
• Experience with a GRC or TPRM platform such as Anecdotes, Vanta, Drata, Secureframe, OneTrust, Whistic, or similar.
• Comfort assessing vendors operating cloud environments such as AWS, GCP, or Azure and SaaS and AI products that host or process company data.
• Strong written communication for explaining vendor risk to Engineering, Legal, Procurement, and non-technical employees.
• Detail-oriented and organized, able to manage multiple reviews and deadlines without reducing rigor.
• Collaborative approach to cross-functional work rather than gatekeeping.

Culture & Benefits

• Hybrid work in San Mateo or New York.
• Opportunity to grow toward end-to-end ownership of the TPRM workstream, including policies, standards, and tiering criteria.
• Opportunity to design risk models, assessment methods, and automation as vendor volume grows.
• Exposure to AI infrastructure challenges including low-latency inference and scalable model serving.
• Work with engineering and AI research teams on AI/ML vendor adoption and infrastructure provider selection.
• Equity is included in the compensation package; Fireworks AI is an equal-opportunity employer committed to an inclusive environment.