Lead, Third-Party Risk & Security (Remote)

Gongio; Austin (TX); On-site; USD 117,000 - 185,000; Full time

Benefits offered by this job

Medical/dental/vision plans

Wellbeing stipend

Mental health benefits

401(k) program

Education & learning stipend

Flexible vacation

Parental leave

Recharge days

Work from home stipend

Job summary

Gong is seeking an experienced Third Party Risk Manager to join our GRC team in the US. You will own Gong's vendor risk program, establishing baselines and controls, and applying a risk-based approach to due diligence across the vendor lifecycle.

You will collaborate with Procurement, Legal, Security, and Privacy to embed risk requirements into contracts, monitoring, and remediation. The role reports to the Head of GRC and focuses on scalable, compliant programs.

Qualifications

• 7+ years of experience in third-party/vendor risk management, GRC, information security, or a related field.
• Demonstrated ability to establish baselines and controls and take a risk-based approach to vendor reviews.
• Strong working knowledge of security and compliance frameworks (SOC 2, ISO 27001, NIST) and privacy regulations.
• Experience conducting vendor risk assessments and interpreting security documentation (SOC 2 reports, pen test results, questionnaires).
• Excellent cross-functional collaboration and communication skills, with the ability to translate risk into business terms.

Responsibilities

• Own the end-to-end third-party risk lifecycle: intake, due diligence, risk assessment, onboarding, ongoing monitoring, and offboarding.
• Establish baselines and controls to reduce and manage third-party risk across the vendor portfolio.
• Apply a risk-based approach to vendor reviews, tiering vendors and scaling due diligence by risk and data sensitivity.
• Build a robust and scalable TPRM program that grows with Gong.
• Conduct vendor risk assessments across security, privacy, compliance, financial, and operational domains; communicate findings clearly.
• Partner with Procurement and Legal to embed risk requirements into contracts and data processing agreements.
• Maintain and enhance the TPRM framework, policies, and procedures per SOC 2, ISO 27001, GDPR/CCPA.
• Manage ongoing monitoring, reassessments, tiering, and remediation tracking.
• Administer and optimize TPRM tooling and automation to scale the program.
• Report on third-party risk posture and trends to GRC leadership.
• Support audit and customer assurance activities related to third-party risk.
• Experience handling security agreements between vendors and holding vendors accountable.

Skills

Vendor risk mgmt

GRC

Information security

Cross-functional collaboration

Security frameworks

Privacy regulations

TPRM tooling

Tools

Zip

Job description

Gong is seeking an experienced Third Party Risk Manager to join our GRC team in the US. You will own Gong's vendor risk program, establishing baselines and controls, and applying a risk-based approach to due diligence across the vendor lifecycle.

You will collaborate with Procurement, Legal, Security, and Privacy to embed risk requirements into contracts, monitoring, and remediation. The role reports to the Head of GRC and focuses on scalable, compliant programs.