Responsibilities
• Review simulated vendor SOC 2 reports, security questionnaires, and pen-test evidence against a buyer’s security standard
• Catch scope mismatches and lapsed bridge letters that a surface-level review would miss
• Author step-level rubrics and golden responses capturing how an experienced security reviewer would judge a request or renewal
• Assess data-handling and sub-processor risk for vendors touching sensitive data

Requirements
• 8+ years of professional experience in security review, vendor risk management, or third-party risk (TPRM)
• Hands-on experience evaluating SOC 2 reports, security questionnaires, and compliance evidence
• Strong written communication skills; comfortable producing structured, rubric-style feedback

Preferred
• Relevant security certification, such as CISSP or CISA
• Prior task-writing, rubric-authoring, or AI-training data experience

How to Apply
Click "Apply" to be taken to the Mercor website. This is not a specific job posting but an application to join their talent network. Complete your profile by uploading your resume and confirming your work location. Once verified, you will be matched to opportunities as they arise. Please note that this role cannot support H1B or STEM OPT candidates. Applying through our link supports WFH Bulletin as a referral partner, but you are welcome to apply directly if you prefer.