Senior Third-Party Risk & Security Lead — Remote

Gong; Austin (CO); On-site; USD 117,000 - 185,000; Full time

Benefits offered by this job

Medical, dental, and vision plans

Wellbeing fund

Mental health benefits

401(k) program

Education stipend

Flexible vacation time

Parental leave

Quarterly recharge days

Work from home stipend

Job summary

Gong is seeking an experienced Third Party Risk Manager to mature Gong's vendor risk program. You will partner with Procurement, Legal, Security, Privacy, and business stakeholders to assess, monitor, and mitigate risks across the vendor lifecycle.

The role reports into the Head of GRC and combines strategic and hands-on work. The position involves evaluating security agreements with vendors and ensuring contracts, DPAs, and onboarding workflows embed risk requirements while aligning with

Qualifications

• 7+ years in third-party/vendor risk management, GRC, information security, or related field.
• Ability to establish baselines and risk-based vendor reviews.
• Familiarity with SOC 2, ISO 27001, NIST and data privacy regulations.

Responsibilities

• Own the end-to-end third-party risk lifecycle: intake, due diligence, risk assessment, onboarding, ongoing monitoring, and offboarding.
• Establish baselines and controls to reduce and manage third-party risk across vendor portfolio.
• Apply a risk-based approach to vendor reviews, tiering vendors and adjusting due diligence depth.
• Build a scalable TPRM program that grows with Gong.
• Conduct vendor risk assessments across security, privacy, compliance, financial, and operational areas.

Skills

Vendor risk management

Cross-functional collaboration

Security frameworks (SOC 2, ISO 27001,

NIST knowledge

Communication

TPRM tooling (Zip)

Education

Bachelor's degree in a related field

Tools

Zip

Job description

Gong is seeking an experienced Third Party Risk Manager to mature Gong's vendor risk program. You will partner with Procurement, Legal, Security, Privacy, and business stakeholders to assess, monitor, and mitigate risks across the vendor lifecycle.

The role reports into the Head of GRC and combines strategic and hands-on work. The position involves evaluating security agreements with vendors and ensuring contracts, DPAs, and onboarding workflows embed risk requirements while aligning with