Supply Chain Risk Lead

About this role

ABOUT US

Legora is redefining how legal work gets done. Not built for lawyers, built with them. We work alongside the world’s best legal teams, who expect excellence, precision, and speed, and we hold ourselves to the same bar.

Our AI-native workspace lets legal professionals move faster, think more clearly, and operate with sharper precision. By analysing thousands of documents in minutes and powering end-to-end workflows, we cut through complexity, teams can focus on what matters: judgment, strategy, and outcomes.

1,000+ customers across 50+ countries trust us, including Cleary Gottlieb, Goodwin, Linklaters, White & Case, Dentons, and Barclays. We’ve scaled to $100M+ in ARR, with teams across Europe, North America and APAC, and continue to expand through acquisitions including Qura, Walter AI and Graceview.

We partner with world-class performers: including Aaron Judge and the New York Yankees, Ludvig Åberg (and his caddie), and campaigns featuring Jude Law.

Joining Legora means three things.

- We lean in: ownership over titles, outcomes over intentions.

- We fight for excellence: high standards, direct, ego-free feedback.

- We grow together: as a team and with our customers.

Mission before ego. Everyone contributes. No one coasts.

If you’re driven by impact, pace, and raising the bar. This is the place.

THE ROLE

You will own Legora's Supply Chain Risk Management program end to end. This is deliberately not a traditional TPRM role. TPRM asks "did the vendor answer our questions?", questionnaire, tier, file the SOC 2, reassess in twelve months. SCRM asks "which dependencies can hurt us, how badly, and what do we control about it?" Every assessment you produce should change a decision: which control gets funded, which dependency gets a contingency plan, which vendor gets dropped.

You will sit in the Security organization and run the program the way an AI-native company should: AI agents handle the repetitive work, your time goes to judgment. The program is built on three lenses applied to every provider we depend on: criticality, resiliency, and exposure.

What You'll Do

Criticality

- Maintain a living dependency map: what sits in the critical path, what is a single point of failure, what depends on what (fourth parties included). The map derives from the SaaS Enablement & Governance Lead's portfolio system of record, one inventory, two lenses.

- Tier dependencies by what actually breaks when a provider fails, not by contract value or questionnaire score.

Resiliency

- Answer, for every critical dependency: what happens when it degrades, and how fast do we recover?

- Own concentration-risk analysis, exit and contingency plans, and resilience requirements that shape architecture and procurement before a provider is adopted.

Exposure

- Know what each provider can see, touch, and reach, data categories, access paths, blast radius.

- Detect use-case drift continuously: new integrations, new data types, access that doesn't match the approved use.

Program and automation

- Run the program: intake, assessment, continuous monitoring, supplier-incident coordination, off-boarding.

- Work the seam with the SaaS Enablement & Governance Lead: intake arrives through their front door and your requirements gate adoption; they enforce those requirements commercially in contracts and renewals; on off-boarding they execute teardown and you verify risk closure for critical vendors.

- Orchestrate AI agents for evidence gathering, drift detection, and triage, with human-in-the-loop where assurance demands it. Anything manual twice a quarter gets automated.

- Prioritize first-party mitigations: we can't change a vendor's controls, but we can scope access, restrict egress, and minimize data on our side.

- Express supply chain risk in loss-event terms (FAIR or similar) so leadership can compare it against other investments, no heat-maps with 18 risks in the yellow square.

- Own subprocessor governance: the register, customer notification commitments, and the assurance story we give law-firm security teams.

- Report metrics that show risk reduction, not activity: drift caught and resolved, time to assess, resilience posture of critical dependencies.

What You Bring

- 6-8+ years in third-party/supply-chain risk, security risk, or related, with weight given to candidates who have stood up a program (not just run one).

- Experience running third-party or supply chain risk in a SaaS or cloud-native environment, with clear opinions on where traditional TPRM fails.

- Hands-on automation ability: scripting, APIs, LLM/agent workflows. Pipelines, not spreadsheets.

- Risk quantification you can defend to a CFO.

- Fluency in the assurance landscape our customers care about: SOC 2, ISO 27001, GDPR subprocessor obligations, DORA-style operational resilience, and AI-provider assurance (model providers are supply chain too).

- Judgment on AI in the loop, grounded in daily use of AI tools in your own work: what to delegate to agents, what needs a human, and how to evidence both to an auditor.

Nice to have

- Experience assessing AI/LLM providers as dependencies: model change management, training-data terms, availability commitments.

- Standing up continuous monitoring or a risk-operations function from scratch.

- Experience in legal tech, fintech, or another high-trust B2B environment.

WHAT’S IN IT FOR YOU

- Global collaboration: Partner with teams and clients across Europe, APAC, and North America.

- Competitive package: Comprehensive salary, benefits, and tools for success.

- Meaningful work: Your efforts shape how thousands of lawyers use AI daily.

- In-person environment: Union Square office designed for ambitious builders and company provided lunch daily.

- Benefits & Perks: We invest in our people with a comprehensive, thoughtfully designed benefits package: Medical, Dental & Vision - Multiple medical plan options through Aetna and Kaiser

Similar jobs

• Supply Chain Operations Lead — Podium-automation · New York City
• Supply Chain Risk Management Specialist — Accenturefederalservices · Arlington, VA
• Operations Risk Lead — Kalshi · Remote
• Supply Chain Systems & Process Lead — Lambda · San Jose Office (Zanker)
• Lead Supply Chain Manager — Archer56 · San Jose, California, United States
• Security Risk Lead — Fastly · Remote
• Supply Chain Manager — Radiant-industries · El Segundo, CA
• Supply Chain Manager — Generalmatter · Los Angeles, CA