Lead Third-Party Risk & Security Manager

Guild Mortgage; United States; On-site; USD 95,000 - 136,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

AD&D

LTD

401(k) with employer match

Job summary

Guild Mortgage Company seeks a Third-Party Security Manager to lead the organization’s TPRM program, overseeing vendor risk identification, assessment, monitoring, and mitigation with cross-functional collaboration to align with risk tolerance and regulatory standards.

The role requires cybersecurity, risk management, and vendor governance expertise, with the ability to communicate risk to technical and executive audiences and drive program maturity.

Qualifications

• Bachelor's degree related to the position or equivalent, preferred.
• Minimum five years' experience.
• Minimum three years supervisory or leadership experience.
• Excellent verbal and written communication skills required.

Responsibilities

• Develop, maintain, and continuously improve the TPRM framework, policies, standards, and procedures.
• Define vendor risk assessment methodologies and risk scoring criteria.
• Ensure alignment with regulatory requirements and industry frameworks (NIST, SOC 2, ISO 27001, FFIEC, GLBA, PCI-DSS, privacy regs).
• Conduct risk assessments for new and existing vendors.
• Review vendor security documentation and remediation plans.
• Collaborate with Procurement, Legal, Privacy, Compliance, and Information Security teams.
• Present vendor risk findings to leadership and risk committees.
• Support audits related to vendor management controls.

Skills

Leadership

Communication

Customer service

Detail-oriented

Teamwork

Education

Bachelor's degree

Tools

Microsoft Office

Wiki

Cloud-based tools

Job description

Guild Mortgage Company seeks a Third-Party Security Manager to lead the organization’s TPRM program, overseeing vendor risk identification, assessment, monitoring, and mitigation with cross-functional collaboration to align with risk tolerance and regulatory standards.

The role requires cybersecurity, risk management, and vendor governance expertise, with the ability to communicate risk to technical and executive audiences and drive program maturity.