Third-Party Security Manager

Position Summary: The Third-Party Security Manager is responsible for leading and maturing the organization's Third-Party Risk Management (TPRM) program. This role oversees the identification, assessment, monitoring, and mitigation of risks associated with vendors, suppliers, service providers, business partners, and other third parties. The position works closely with Information Security, Legal, Compliance, Procurement, Privacy, Enterprise Risk Management, and business stakeholders to ensure third-party relationships align with organizational risk tolerance, regulatory requirements, and security standards. The Third-Party Security Manager possesses strong cybersecurity, risk management, and vendor governance experience with the ability to communicate risk effectively to both technical and executive audiences.

Compensation: This role is an exempt position with a Targeted Salary Range of $94,882 to $136,097 annually. Compensation at Guild is influenced by a wide array of factors including but not limited to local and federal minimum wage requirements, education, level of experience, and applicant's geographical location.

Essential Functions: Develop, maintain, and continuously improve the Third-Party Risk Management (TPRM) framework, policies, standards, and procedures. Establish risk-based processes for onboarding, reviewing, monitoring, and offboarding third parties. Define vendor risk assessment methodologies and risk scoring criteria. Ensure alignment with regulatory requirements and industry frameworks including NIST, SOC 2, ISO 27001, FFIEC, GLBA, PCI-DSS, and applicable privacy regulations. Conduct security, privacy, operational, compliance, and business continuity risk assessments for new and existing vendors. Review vendor security documentation including: SOC 1 and SOC 2 reports, ISO certifications, Penetration test reports, Vulnerability management reports, Security questionnaires, Business continuity and disaster recovery plans, Identify control gaps and work with vendors and stakeholders on remediation plans. Evaluate fourth-party dependencies and concentration risks. Maintain an inventory of third-party relationships and associated risk ratings. Develop continuous monitoring processes for critical and high-risk vendors. Monitor external security ratings, threat intelligence, breach activity, financial condition, and compliance status of vendors. Track remediation activities and ensure timely closure of identified risks. Facilitate periodic vendor reviews and risk re-assessments. Partner with Procurement, Legal, Privacy, Compliance, Business Owners, and Information Security teams during vendor selection and contract negotiations. Provide risk guidance to business leaders regarding vendor onboarding and ongoing risk management decisions. Present vendor risk findings and recommendations to leadership committees, risk committees, and executive management. Support internal and external audits related to vendor management controls. Collaborate with Legal and Procurement to establish and maintain security and privacy contractual requirements. Review and recommend contract language related to: Information security controls, Data protection requirements, Breach notification obligations, Audit rights, Business continuity requirements, Regulatory compliance obligations. Ensure vendor agreements include appropriate security, privacy, and reporting requirements. Develop and maintain TPRM dashboards, KPIs, and executive reporting. Track vendor assessment volumes, remediation status, risk trends, and program maturity metrics. Provide regular reporting to Information Security leadership, Enterprise Risk Management, and audit committees. Support risk quantification and business impact analysis efforts.

Requirements: Physical: Work is primarily sedentary; mobility in an office setting. Manual Dexterity: Frequent use of computer keyboard and mouse. Audio/Visual: Ability to accurately interpret sounds and associated meanings at a volume consistent with interpersonal conversation. Regularly required to accurately perceive, distinguish and interpret information received visually and through audio, e.g., words, numbers and other data broadcasted aloud/viewed on a screen, as well as print and other media. Environmental: Office environment – moderate noise, no substantial exposure to adverse environmental conditions. Mental: Learn new tasks, remember processes, maintain focus, complete tasks independently, and make timely decisions in the context of a workflow. This role requires effective adaptation to workplace stressors, including customer service complaints, security responsibilities, and competing priorities. Must be able to adhere to process protocol. Must be able to apply established protocols in a timely manner. Schedules: Work is primarily performed during the business week, Monday - Friday.

Travel: 5% or less