Gongio

Senior Security GRC Lead

Austin | Chicago | New York City | Salt Lake City | San Francisco · Senior

Sponsorship not specified$121k-$185kDetected 16 days ago

ComplianceSalesHIPAACommunication

About the role

The Gong Revenue AI Operating System unifies data, insights, and workflows into a single, trusted system that observes, guides, and acts alongside the world's most successful revenue teams.

Design and implement Gong's Common Controls Framework, mapping controls across SOC 2, ISO 27001, 27017, 27701, 27018, HIPAA, PCI, and other applicable frameworks.
Rationalize overlapping requirements across frameworks to reduce compliance burden and create a single source of truth for control ownership.
Partner with Engineering, Infrastructure, and Product Security to embed controls at the architecture level, not just as audit checkboxes.
Build Gong's product & enterprise risk register from the ground up - defining risk taxonomy, scoring methodology, risk appetite thresholds, and ownership models.
Implementation of a GRC platform and system of record, and ability to build executive level dashboards to track vulnerability, risk, and control remediation.
Create and maintain risk treatment plans in partnership with risk owners across the business, tracking remediation milestones and escalating blockers.
Develop executive-level risk reporting cadences and dashboards for the Head of GRC and senior leadership.
Own the complete lifecycle of Gong's information security policy suite - creation, review cycles, version control, and employee acknowledgment tracking.
Drive policy adoption through clear communication, training support, and cross-functional partnership.

Deep expertise across multiple compliance and security frameworks, including SOC 2 Type II, ISO 27001, NIST CSF, and at least one regulatory framework (GDPR, CCPA, HIPAA, or equivalent).
Experience creating and implementing GRC Record of Truth/Tooling.
Experience conducting and managing product & enterprise risk assessments, with a working knowledge of risk quantification methodologies.
Bachelor's degree in Information Security, Computer Science, Business, or a related field
7+ years of progressive experience in GRC, Information Security, or a closely related function - with meaningful time spent building or scaling programs, not just running them.
Demonstrated hands-on experience building a GRC program at scale - ideally in a high-growth SaaS or technology company.
Strong policy and standards writing ability - capable of translating complex regulatory language into clear, actionable documentation.
Proven ability to manage and communicate with senior stakeholders, including Legal, Engineering, and executive audiences.
Bachelor's degree in Information Security, Computer Science, Business, or a related field; equivalent practical experience considered.

CISSP, CISM, CRISC, CISA, CCSP, or comparable credentials.
Relevant certifications strongly preferred: CISSP, CISM, CRISC, CISA, CCSP, or comparable credentials.

At Gong, we have a location-based compensation structure, which means there may be a different range for candidates in other locations.
The total compensation package for this position, in addition to base compensation, may include incentive compensation, bonus, equity, and benefits.
Some of our sales compensation programs also offer the potential to achieve above targeted earnings for those who exceed their sales targets.
So if this sounds like something that interests you regardless of compensation, please reach out.
The annual salary hiring range for this position is $121,000 - $185,000 USD.

We offer Gongsters a variety of medical, dental, and vision plans, designed to fit you and your family's needs.
Wellbeing Fund - flexible wellness stipend to support a healthy lifestyle.
Mental Health benefits with covered therapy and coaching.
Education & learning stipend for personal growth and development.
Flexible vacation time to promote a healthy work-life blend.
Paid parental leave to support you and your family.
Work from home stipend to help you succeed in a remote environment.
Compensation is based on factors unique to each candidate, including, but not limited to, job-related skills, qualification, education, experience, and location.

At Gong, we have a location-based compensation structure, which means there may be a different range for candidates in other locations.

This listing is sourced directly from Gongio's careers page and normalized into a canonical job model.