Risk Manager

About the role

You will own Legora's Supply Chain Risk Management program end to end. This is deliberately not a traditional TPRM role. TPRM asks "did the vendor answer our questions?", questionnaire, tier, file the SOC 2, reassess in twelve months. SCRM asks "which dependencies can hurt us, how badly, and what do we control about it?" Every assessment you produce should change a decision: which control gets funded, which dependency gets a contingency plan, which vendor gets dropped. You will sit in the Security organization and run the program the way an AI-native company should: AI agents handle the repetitive work, your time goes to judgment.

Responsibilities

• Maintain a living dependency map: what sits in the critical path, what is a single point of failure, what depends on what (fourth parties included).
• Tier dependencies by what actually breaks when a provider fails, not by contract value or questionnaire score.
• Own concentration-risk analysis, exit and contingency plans, and resilience requirements that shape architecture and procurement before a provider is adopted.
• Know what each provider can see, touch, and reach, data categories, access paths, blast radius.
• Detect use-case drift continuously: new integrations, new data types, access that doesn't match the approved use.
• Run the program: intake, assessment, continuous monitoring, supplier-incident coordination, off-boarding.
• Work the seam with the SaaS Enablement & Governance Lead: intake arrives through their front door and your requirements gate adoption; they enforce those requirements commercially in contracts and renewals; on off-boarding they execute teardown and you verify risk closure for critical vendors.
• Orchestrate AI agents for evidence gathering, drift detection, and triage, with human-in-the-loop where assurance demands it.
• Prioritize first-party mitigations: we can't change a vendor's controls, but we can scope access, restrict egress, and minimize data on our side.
• Express supply chain risk in loss-event terms (FAIR or similar) so leadership can compare it against other investments, no heat-maps with 18 risks in the yellow square.
• Own subprocessor governance: the register, customer notification commitments, and the assurance story we give law-firm security teams.
• Report metrics that show risk reduction, not activity: drift caught and resolved, time to assess, resilience posture of critical dependencies.

Requirements

• 6-8+ years in third-party/supply-chain risk, security risk, or related, with weight given to candidates who have stood up a program (not just run one).
• Experience running third-party or supply chain risk in a SaaS or cloud-native environment, with clear opinions on where traditional TPRM fails.
• Hands-on automation ability: scripting, APIs, LLM/agent workflows. Pipelines, not spreadsheets.
• Risk quantification you can defend to a CFO.
• Fluency in the assurance landscape our customers care about: SOC 2, ISO 27001, GDPR subprocessor obligations, DORA-style operational resilience, and AI-provider assurance (model providers are supply chain too).
• Judgment on AI in the loop, grounded in daily use of AI tools in your own work: what to delegate to agents, what needs a human, and how to evidence both to an auditor.

Qualifications

• Nice to have: Experience assessing AI/LLM providers as dependencies: model change management, training-data terms, availability commitments.
• Standing up continuous monitoring or a risk-operations function from scratch.
• Experience in legal tech, fintech, or another high-trust B2B environment.

Skills

• Fluency in the assurance landscape our customers care about: SOC 2, ISO 27001, GDPR subprocessor obligations, DORA-style operational resilience, and AI-provider assurance (model providers are supply chain too).
• Judgment on AI in the loop, grounded in daily use of AI tools in your own work: what to delegate to agents, what needs a human, and how to evidence both to an auditor.

Benefits

Global collaboration: Partner with teams and clients across Europe, APAC, and North America.
Competitive package: Comprehensive salary, benefits, and tools for success.
Meaningful work: Your efforts shape how thousands of lawyers use AI daily.
In-person environment: Union Square office designed for ambitious builders and company provided lunch daily.
Legora is an Equal Opportunity Employer
At Legora, we believe great teams are built on diversity of thought and experience. We’re proud to be an equal opportunity employer and committed to creating an inclusive, high-performance culture where everyone can do their best work. We welcome people of all backgrounds and don’t discriminate based on race, color, religion, national origin, gender, gender identity or expression, sexual orientation, age, disability, veteran status, or any other characteristic protected by law.