AI-Driven Vendor Risk & Compliance Engineer

WebMD; Newark (NJ); On-site; USD 82,000 - 97,000; Full time

Benefits offered by this job

Health Insurance (medical, dental, and

401(k) Retirement Plan with employer

Paid Time Off

Life and Disability Insurance

Employee Assistance Program (EAP)

Commuter and/or Transit Benefits

Job summary

WebMD is seeking a Vendor Risk & Compliance Engineer to enhance the vendor risk program using AI, aligning vendors and products to NIST, HIPAA, and SOC2. You will lead end-to-end vendor security risk assessments, quantify risk, and partner with risk owners to drive remediation.

Reporting to the Sr. Director of Privacy and Compliance, you will own risk reporting in OneTrust, develop KRIs/KPIs, and evolve assessment methodologies.

Qualifications

• 4-6 years leading vendor and third-party risk assessments (security, vendor, HIPAA, etc.).
• Strong command of risk and control concepts and GRC frameworks (NIST RMF, NIST 800-53r5).
• Experience leading discussions with risk owners to develop and close risk treatment plans.
• Hands-on experience with GRC tooling (OneTrust, Archer).
• Experience building and maintaining organizational security risk metrics.
• Excellent written and verbal communication with the ability to manage deadlines.

Responsibilities

• Continuous improvement using AI into all aspects of vendor risk management.
• Lead and independently prioritize vendor security risk assessments by service type and integration profile.
• Coordinate vendor information risk activities across procurement, legal, and the business, including SOC 2 focus.
• Design and negotiate risk treatment plans with risk owners and track to closure.
• Lead vendor risk reviews in bi-weekly management meetings.
• Own risk reporting in OneTrust and develop KRIs and KPIs.
• Build and improve assessment methodologies and questionnaires based on NIST 800-53r5 and NIST RMF.
• Embed security-by-design into projects to mitigate risk before it materializes.
• Support internal assessments and external audits.

Skills

AI proficiency

Vendor risk assessments

GRC frameworks

Stakeholder communication

OneTrust / Archer

Education

Bachelor's degree

Tools

OneTrust

Archer

Job description

WebMD is seeking a Vendor Risk & Compliance Engineer to enhance the vendor risk program using AI, aligning vendors and products to NIST, HIPAA, and SOC2. You will lead end-to-end vendor security risk assessments, quantify risk, and partner with risk owners to drive remediation.

Reporting to the Sr. Director of Privacy and Compliance, you will own risk reporting in OneTrust, develop KRIs/KPIs, and evolve assessment methodologies.