Legora Third-Party Risk Lead at Legora responsible for leading the third-party risk program within Security. Assess suppliers, manage risk, and ensure mitigation and contingency plans for critical providers.
Responsibilities
Legora builds AI software for legal work. Our products and operations depend on cloud platforms, AI model providers, software vendors, and other service partners. We need to understand which dependencies could disrupt our service or put information at risk, and act on that understanding.
Assess suppliers in context. Understand the service being purchased, the information it will handle, the access it needs, and the consequences of failure. Set the depth of each review accordingly. Examine supplier evidence and investigate gaps with the relevant technical teams.
Understand our critical dependencies. Maintain a view of critical providers, their key subcontractors, and dependencies shared across services. Identify where we depend heavily on one provider or would struggle to replace it.
Turn findings into action. Recommend approval conditions and practical mitigations, including changes to access, data sharing, or how a service is used. Agree owners and deadlines, track completion, and escalate unresolved risks for an authorized decision.
Prepare for supplier failure. Work with Engineering and service owners on contingency, recovery, and exit plans for critical providers. Check whether those plans have been tested and make remaining gaps visible.
Manage risk throughout the relationship. Build reviews into onboarding, material service changes, renewals, and offboarding. Define when reassessment is needed and coordinate follow-up after supplier incidents. Keep subprocessor information accurate and work with Legal on customer notification commitments.
Improve how assessments run. Set clear review standards and check assessment quality. Use automation and AI where they improve evidence collection or follow-up, with traceable sources and checks on their output.
Give leadership a useful view of risk. Report assessment coverage, unresolved material findings, overdue actions, and the readiness of critical suppliers’ contingency plans. Explain the decisions needed and the consequences of delaying them.
You own the risk assessment and oversight process. Business owners remain responsible for their supplier relationships and authorized risk acceptance. You will work with Engineering on technical changes and with Procurement and Legal on commercial and contractual requirements.
What you will bring
Experience building or substantially improving a third-party or technology risk program in a SaaS or cloud environment.
Hands-on supplier assessment experience, including interpreting assurance reports, challenging unsupported claims, and writing clear recommendations.
