Strategic TPRM & Security Lead

Gong; New York (NY); On-site; USD 117,000 - 185,000; Full time

Benefits offered by this job

Medical, dental, and vision plans

Wellbeing Fund

Mental Health benefits

401(k) program

Education & learning stipend

Flexible vacation

Paid parental leave

Quarterly recharge days

Work from home stipend

Job summary

Gong is seeking an experienced Third Party Risk Manager to join our Governance, Risk, and Compliance team. You will own and mature Gong's third-party risk management program, ensuring vendors meet security, privacy, compliance, and resilience standards.

You will establish baselines and controls that Gong can implement and apply a risk-based approach to vendor reviews, prioritizing critical vendors based on risk and data sensitivity.

Qualifications

• 7+ years of experience in third-party/vendor risk management, GRC, information security, or a related field.
• Strong knowledge of SOC 2, ISO 27001, NIST and data privacy regulations.
• Experience conducting vendor risk assessments and interpreting security documentation.
• Excellent cross-functional collaboration and communication skills.
• Experience with TPRM tooling (Zip).
• Certifications like CTPRP, CISA, CISSP, CRISC are a plus.

Responsibilities

• Own the end-to-end third-party risk lifecycle: intake, due diligence, risk assessment, onboarding, ongoing monitoring, and offboarding.
• Establish baselines and controls to reduce and manage third-party risk across vendors.
• Apply a risk-based approach to vendor reviews and tiering according to risk and data sensitivity.
• Build a scalable TPRM program to support Gong's growth.
• Conduct vendor risk assessments across multiple domains and communicate findings.
• Partner with Procurement and Legal to embed risk requirements into contracts and data processing agreements.
• Maintain and enhance the TPRM framework in line with SOC 2 and privacy regulations.
• Manage ongoing monitoring and remediation tracking for the vendor portfolio.
• Administer and optimize TPRM tooling and automation.
• Report on third-party risk posture and trends to GRC leadership.
• Support audit and customer assurance activities related to third-party risk.
• Experience handling security agreements and enforcing vendor accountability.

Skills

Vendor risk mgmt

GRC

SOC 2

ISO 27001

NIST

Vendor assessments

Cross-functional

Zip tooling

Certs preferred

Tools

Zip

Job description

Gong is seeking an experienced Third Party Risk Manager to join our Governance, Risk, and Compliance team. You will own and mature Gong's third-party risk management program, ensuring vendors meet security, privacy, compliance, and resilience standards.

You will establish baselines and controls that Gong can implement and apply a risk-based approach to vendor reviews, prioritizing critical vendors based on risk and data sensitivity.