Security Expert

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Expert based in Canada.

This contract role is an opportunity for an experienced security professional to apply deep expertise in third-party and vendor risk to the evaluation of AI-generated security assessments. You will review SOC 2 reports, security questionnaires, penetration-testing evidence, and related compliance materials against defined security standards. Your judgment will help identify subtle risks and inconsistencies that may be missed during surface-level reviews. You will also develop detailed evaluation rubrics and model responses that reflect how experienced security reviewers assess real-world requests. The role involves assessing data-handling practices and sub-processor risks for vendors managing sensitive information. You will work remotely and asynchronously, with a high degree of independence and a direct impact on improving AI model performance.

Accountabilities

• Review simulated vendor SOC 2 reports, security questionnaires, penetration-testing evidence, and compliance documentation against established security standards.
• Identify scope mismatches, outdated documentation, lapsed bridge letters, and other issues that may be overlooked in high-level reviews.
• Assess vendor security posture and identify potential risks associated with data handling, access, and sub-processors.
• Create detailed, step-level evaluation rubrics that capture how an experienced security professional would assess a request, vendor, or renewal.
• Develop high-quality reference or “golden” responses to guide AI models toward accurate and security-conscious evaluations.
• Provide structured, actionable feedback that supports the improvement of AI-generated security assessments.
• Work independently and asynchronously while maintaining high standards of accuracy and meeting project deadlines.

Requirements

• 8+ years of professional experience in security review, vendor risk management, third-party risk management (TPRM), or a closely related discipline.
• Hands-on experience reviewing SOC 2 reports, security questionnaires, penetration-testing evidence, and other security or compliance documentation.
• Strong understanding of vendor security assessments, third-party risk, data protection, and sub-processor risk.
• Excellent written communication skills, with the ability to produce clear, structured, and rubric-based feedback.
• Strong attention to detail and the ability to identify nuanced security gaps, inconsistencies, and documentation issues.
• Ability to apply professional judgment independently and work effectively in a remote, asynchronous environment.
• A relevant security certification, such as CISSP or CISA, is preferred.
• Previous experience with task writing, rubric development, AI training data, or similar evaluation work is an advantage.

Benefits

• Competitive contract compensation of $90–$110 per hour.
• Fully remote work environment.
• Flexible, asynchronous working structure.
• Opportunity to apply advanced security expertise to the development and evaluation of AI systems.
• Meaningful contribution to improving the accuracy and reliability of AI-generated security assessments.
• Independent work with the flexibility to manage assignments around agreed deadlines.