Third-Party Security Manager

The Third-Party Security Manager is responsible for leading and maturing the organization's Third-Party Risk Management (TPRM) program. This role oversees the identification, assessment, monitoring, and mitigation of risks associated with vendors, suppliers, service providers, business partners, and other third parties. The position works closely with Information Security, Legal, Compliance, Procurement, Privacy, Enterprise Risk Management, and business stakeholders to ensure third-party relationships align with organizational risk tolerance, regulatory requirements, and security standards. The Third-Party Security Manager possesses strong cybersecurity, risk management, and vendor governance experience with the ability to communicate risk effectively to both technical and executive audiences.

• Develop, maintain, and continuously improve the Third-Party Risk Management (TPRM) framework, policies, standards, and procedures.
• Establish risk-based processes for onboarding, reviewing, monitoring, and offboarding third parties.
• Define vendor risk assessment methodologies and risk scoring criteria.
• Ensure alignment with regulatory requirements and industry frameworks including NIST, SOC 2, ISO 27001, FFIEC, GLBA, PCI-DSS, and applicable privacy regulations.
• Conduct security, privacy, operational, compliance, and business continuity risk assessments for new and existing vendors.
• Review vendor security documentation including: SOC 1 and SOC 2 reports, ISO certifications, Penetration test reports, Vulnerability management reports, Security questionnaires, Business continuity and disaster recovery plans,
• Identify control gaps and work with vendors and stakeholders on remediation plans.
• Evaluate fourth-party dependencies and concentration risks.
• Maintain an inventory of third-party relationships and associated risk ratings.
• Develop continuous monitoring processes for critical and high-risk vendors.
• Monitor external security ratings, threat intelligence, breach activity, financial condition, and compliance status of vendors.
• Track remediation activities and ensure timely closure of identified risks.
• Facilitate periodic vendor reviews and risk re-assessments.
• Partner with Procurement, Legal, Privacy, Compliance, Business Owners, and Information Security teams during vendor selection and contract negotiations.
• Provide risk guidance to business leaders regarding vendor onboarding and ongoing risk management decisions.
• Present vendor risk findings and recommendations to leadership committees, risk committees, and executive management.
• Support internal and external audits related to vendor management controls.
• Collaborate with Legal and Procurement to establish and maintain security and privacy contractual requirements.
• Review and recommend contract language related to: Information security controls, Data protection requirements, Breach notification obligations, Audit rights, Business continuity requirements, Regulatory compliance obligations.
• Ensure vendor agreements include appropriate security, privacy, and reporting requirements.
• Develop and maintain TPRM dashboards, KPIs, and executive reporting.
• Track vendor assessment volumes, remediation status, risk trends, and program maturity metrics.
• Provide regular reporting to Information Security leadership, Enterprise Risk Management, and audit committees.
• Support risk quantification and business impact analysis efforts.

• Bachelors Degree directly related to the position or equivalent, preferred.
• Minimum five years' experience.
• Minimum three years supervisory or leadership experience
• Excellent verbal and written communication skills required.
• Highly organized and detail-oriented; ability to work in a fast-paced, metrics-driven environment required.
• Proficiency in Microsoft Office Suite, Word, Excel, Wiki, collaborative cloud-based programs, and third-party software applications required.
• Commitment to company values.
• Customer Service - Proactive attention to each person
• Integrity - Do and say what's right
• Respect - Treat others with dignity
• Collaboration - Listen and work together
• Learning - Seek knowledge and strive for improvement
• Excellence – Deliver the unexpected

Guild offers a pleasant work environment, competitive compensation and excellent benefits package; including medical, dental, vision, life insurance, AD&D, LTD and 401(k) with employer match.

Guild Mortgage Company is an Equal Opportunity Employer.

REQ#: THIRD018481

• Job Scope: Responsible for understanding the department/functional area objectives and goals and how own job contributes to achievement of these goals; may recommend changes and enhancements based on analysis and evaluation of circumstances.
• Complexity: General precedents may exist for most problems; conducts independent research/analysis to identify the appropriate approach.
• Impact: Decisions and actions primarily impact own work with limited impact on peers in their area, contributes as team member rather than leader.
• Interaction/Supervision: Acts as a mentor/guide to less experienced professional contributor staff in a similar role; works independently and only under general direction; guided by professional standards, desired outcomes, and project plan specifications.