Senior Third-Party Risk & Security Lead

Gong; San Francisco (CA); On-site; USD 128,000 - 174,000; Full time

Benefits offered by this job

Medical/Dental/Vision plans

Wellbeing stipend

Mental Health benefits

401(k) program

Education & learning stipend

Flexible vacation time

Paid parental leave

Quarterly recharge days

Work from home stipend

Job summary

Gong is seeking an experienced Third Party Risk Manager to lead our Governance, Risk, and Compliance (GRC) team. You will own Gong's third-party risk program, ensuring vendors meet security, privacy, and operational standards while partnering with Procurement, Legal, Security, and Privacy.

You will establish baselines, implement scalable controls, and monitor the vendor lifecycle, from due diligence to offboarding, ensuring alignment with SOC 2, ISO 27001, and privacy regulations.

Qualifications

• 7+ years of experience in third-party/vendor risk management, GRC, information security, or related field.
• Ability to establish baselines and controls and take a risk-based approach to vendor reviews.
• Knowledge of security frameworks (SOC 2, ISO 27001, NIST) and privacy regulations.

Responsibilities

• Own the end-to-end third-party risk lifecycle: intake, due diligence, risk assessment, onboarding, ongoing monitoring, and offboarding.
• Establish baselines and controls to reduce and manage third-party risk across the vendor portfolio.
• Apply a risk-based approach to vendor reviews, tiering vendors and scaling due diligence by risk and data sensitivity.

Skills

Communication

Cross-functional collaboration

Risk assessment

Vendor management

Security awareness

Education

CISSP

CISA

CRISC

CTPRP

Tools

Zip

Job description

Gong is seeking an experienced Third Party Risk Manager to lead our Governance, Risk, and Compliance (GRC) team. You will own Gong's third-party risk program, ensuring vendors meet security, privacy, and operational standards while partnering with Procurement, Legal, Security, and Privacy.

You will establish baselines, implement scalable controls, and monitor the vendor lifecycle, from due diligence to offboarding, ensuring alignment with SOC 2, ISO 27001, and privacy regulations.