Hiring nowAI procurement, vendor assurance and value management

AI Vendor Risk Analyst

Also called Third-Party AI Risk Analyst

An AI Vendor Risk Analyst assesses the external models and services a company depends on, and checks the evidence behind each supplier's controls. It matters because one weak dependency can stall a product or expose customers.

What they do

The analyst reviews external model and service providers before and after purchase. They send vendor questionnaires, read the answers critically and ask for evidence where claims are thin. They run evaluation harnesses to test whether a supplier's model behaves as promised on the company's own tasks. They map where products rely on a single provider, work out what happens if that provider changes terms, degrades or disappears, and agree continuity plans with engineering. They keep a register of risks and benefits, and report what needs treating to product, legal and finance.

What a strong hire delivers

In the first months, a strong hire gives the company a clear view of which external AI dependencies matter most. They produce third-party risk assessments for the highest-impact suppliers and a monitoring plan with owners and triggers. They agree fallback options for the critical dependencies, and they leave a repeatable intake process so new vendors are checked before anyone signs.

How you can tell they are good

Ask for a past assessment, with sensitive detail removed, and have them walk through it. Good candidates explain which risks they ranked highest and why, what evidence they asked for, and what they did when a vendor refused. They should separate material risk from paperwork. Be wary of anyone who talks only about questionnaires and never about testing the model's behaviour.

Why it is hard to fill

The title is rare and the skills sit across several disciplines. Most third-party risk people have never tested a model. Most machine learning engineers have never read a supplier contract or planned for continuity. Candidates with both are few, and they often carry titles like procurement lead or risk manager. We usually search by the work done, not the job title, and accept a strong base in one area with evidence of learning the other.

Where to find them

Look at third-party risk and vendor assurance teams in financial services, insurance and other regulated sectors. Procurement specialists who have bought software or data services are another source, as are technology evaluation and architecture roles. Some come from finance, running benefit tracking and commercial analysis. A smaller group sits in AI governance or model risk teams, and some work at AI-heavy scale-ups that rely on several model providers.

Indicative pay

Not enough published evidence yet to give a fair range for this role, which is common for work this new. We benchmark it for you as part of a search.

Interview questions for an AI Vendor Risk Analyst

  1. Tell me about a supplier dependency you assessed that turned out riskier than it first looked. What did you find and do?

    A strong answer names the specific evidence that changed their view and the action taken, such as a fallback or contract change. Worry if the story is only about forms completed, with no judgement or outcome.

  2. How would you test whether a model provider's claims hold up on our own use case?

    Look for building a representative test set, defining pass criteria, running an evaluation harness and repeating it after provider updates. Worry if they rely on public benchmarks or vendor demos alone.

4 more questions, with what a strong answer covers, are in the Role Kit.

Job description you can post

We use external models and AI services across our products, and we want someone to make sure we understand what we depend on. You will assess suppliers, test their claims, and build the plans that keep us running when things change.

What you will do

  • Assess external model and AI service providers before purchase and on a regular basis afterwards
  • Review vendor questionnaires and control evidence, and press for more where needed
  • Run evaluation harnesses to test supplier models against our own tasks
  • Map single points of failure and agree continuity plans with engineering
  • Maintain a register of vendor risks, treatments and expected benefits
  • Report material risks and recommendations to product, legal and finance

What you will bring

  • Completed third-party or vendor risk assessments that led to real decisions
  • Experience testing or evaluating model or software behaviour, not just reviewing documents
  • Ability to read contracts and service terms and spot continuity exposure
  • Commercial or financial analysis skills, shown in past work
  • Clear, concise writing for non-specialist decision makers
  • Sound judgement on what is material and what is noise

Nice to have

  • Background in regulated sectors such as financial services
  • Experience with AI governance or model risk frameworks
  • Familiarity with agent frameworks and multi-provider setups

Free to use and adapt. If it saves you time, a link back to this page is appreciated.

Skills that matter

  • Procurement and vendor assuranceAdvancedEvaluate external systems against requirements and risks
  • AI risk managementAdvancedIdentify, assess, treat and monitor AI risks
  • Commercial and financial analysisWorkingAssess unit economics and value realisation
  • Model evaluationWorkingMeasure capability and failure modes credibly

Other roles in aI procurement, vendor assurance and value management

Hiring nowAI Procurement SpecialistAn AI Procurement Specialist selects external AI suppliers against use case, cost and risk requirements. They help a company buy the right…EmergingAI Value Realisation AnalystAn AI Value Realisation Analyst checks whether AI deployments create real, verified business value. They give leadership evidence on what to keep…Hiring nowAI Portfolio ManagerAn AI Portfolio Manager decides where a company's AI money and effort go, using comparable evidence, and stops weak projects early. It matters…

Related roles in other families

Hiring nowAI Site Reliability EngineerAI observability, reliability and FinOpsAn AI Site Reliability Engineer keeps services that depend on models available and recoverable under real traffic. They matter because customers…EmergingAI Observability EngineerAI observability, reliability and FinOpsAn AI Observability Engineer instruments model and agent workflows so teams can see what is happening in production. It matters because failures…Hiring nowAI FinOps AnalystAI observability, reliability and FinOpsAn AI FinOps Analyst measures what each useful AI task costs and finds ways to bring it down without hurting quality. They give the company a clear…Hiring nowAI Capacity Planning EngineerAI observability, reliability and FinOpsAn AI Capacity Planning Engineer plans how much compute the company needs, when, and at what cost. They keep services reliable at peak load without…

How we wrote this

Role definitions are our own editorial work, checked against occupational classifications, standards, research and employer pages. Titles vary by company, and this is a description of the work, not a job advert.

← AI procurement, vendor assurance and value managementAll new job families

Start a search

Hiring an AI Vendor Risk Analyst?

Tell us the work. We find the people already doing it, whatever their job title says, and you meet them already interviewed for your role.