About Oneleet

Oneleet is one of the fastest-growing security and compliance platforms in history. We are on a mission to change the compliance and security industry by making cybersecurity and compliance effective, easy, and painless. We provide a platform that helps companies build, manage, and monitor their cybersecurity programs and achieve compliance standards such as SOC 2 and ISO 27001 efficiently, without cutting corners.

Having just raised a $33 million Series A, we are rapidly growing in customers and employees. Our team has decades of experience in security and compliance.

Who We’re Looking For

We value passionate self-starters with a growth mindset and a bias for action and personal accountability. If you love solving hard problems, thrive in ambiguity, and want to make a real impact, you’ll fit right in.

We’re especially drawn to:

• Rebels with a cause — frustrated with the status quo and eager to disrupt it.
• Opinionated builders — decisive yet collaborative, who help us move fast.
• Clear communicators — who own their ideas and follow through.

The Role

Oneleet helps customers understand the security posture of the vendors they use without repeating the same research for every company. Our shared vendor library brings together findings from public sources so customers can make informed decisions faster.

As our Vendor Supply Chain Analyst, you’ll help build and maintain that library. Your core responsibility is verifying AI-generated research: checking findings against saved sources, resolving gaps, and making sure the evidence supports the conclusions. Engineering owns the AI research pipeline; you’ll provide the feedback that makes its output more accurate and useful.

Each shared vendor record has a security posture score. Customer-specific risk scores are calculated separately using each customer’s exposure to that vendor. Your work ensures the underlying vendor research is reliable.

You’ll help work through an initial backlog of approximately 500–600 vendors, prioritizing those used by the most customers. You’ll also help establish how we measure research accuracy and compare computed scores with existing customer-assigned ratings. This is an opportunity to shape how Oneleet evaluates vendor security at scale.

Key Responsibilities

• Verify vendor research: Check AI-generated findings against saved sources, prioritizing vendors by customer usage. Correct unsupported claims and distinguish confirmed findings from missing or inconclusive evidence.
• Build and maintain the vendor library: Research new SaaS vendors, resolve incomplete records, and review significant changes flagged by the pipeline (e.g., breaches, changes to security practices).
• Resolve source-access gaps: Find accessible sources or manually upload documents when the pipeline encounters fetch errors or login barriers.
• Confirm public security claims: Verify evidence for criteria such as SSO availability, published DPAs, subprocessor lists, and SOC 2 reports.
• Measure accuracy and calibrate scoring: Evaluate research accuracy, compare computed scores with existing customer-assigned ratings, investigate differences, and recommend adjustments based on evidence.
• Improve research quality: Document recurring errors, missed evidence, and ambiguous results to provide actionable feedback to the engineering team.
• Recommend criteria updates: Identify gaps or unclear definitions in evaluation criteria and propose updates as vendor practices evolve.
• Maintain defensible evidence: Keep findings traceable to saved sources with clear reasoning and research dates.
• Develop verification runbooks: Document repeatable review steps and escalation paths for consistent decision-making.

Requirements

• Hands-on experience conducting vendor security due diligence or third-party security assessments.
• Strong research skills and sound judgment to distinguish true evidence from marketing claims.
• Familiarity with SaaS security practices and public security, privacy, and compliance documentation.
• Analytical mindset with comfort investigating discrepancies, documenting uncertainty, and auditing scores against underlying evidence.
• Clear written communication and thorough documentation habits.
• Self-starter mindset: ability to take initiative, adapt quickly, thrive in ambiguity, and build processes from scratch.

Bonus Points

• Experience evaluating AI-generated research or designing human review processes.
• Experience measuring research accuracy, calibrating scoring systems, or building quality assurance processes.
• Background in third-party risk, compliance, or security research.
• Experience working in an early-stage startup through rapid growth phases.
• Scripting or automation skills to analyze results or optimize verification processes.

Perks & Benefits

• Comprehensive health & wellness benefits
• 20 days PTO per year, plus 8 floating holidays
• Remote-first work culture
• Team off-sites in stunning locations (e.g., Amsterdam, Italy)
• Competitive compensation & equity