Senior Security GRC Lead

The role

You will architect foundational security and compliance programs including a Common Controls Framework and a formal risk process. You will manage the full policy, standards, and exceptions lifecycle while implementing a GRC tooling ecosystem.

What you will do

• Design and implement Gong’s Common Controls Framework across multiple frameworks.
• Rationalize overlapping requirements across frameworks.
• Partner with Engineering, Infrastructure, and Product Security to embed controls.
• Establish control testing methodology and continuous monitoring processes.
• Serve as subject-matter expert during customer and external audits, RFPs, and sales engagements.
• Build Gong’s product and enterprise risk register from the ground up.
• Implement a GRC platform and build executive level dashboards.
• Create and maintain risk treatment plans in partnership with risk owners.
• Develop executive-level risk reporting cadences and dashboards.
• Own the complete lifecycle of Gong’s information security policy suite.

Required qualifications

• 7+ years of progressive experience in GRC, Information Security, or a closely related function.
• Demonstrated hands-on experience building a GRC program at scale.
• Deep expertise across multiple compliance and security frameworks, including SOC 2 Type II, ISO 27001, NIST CSF, and at least one regulatory framework (GDPR, CCPA, HIPAA, or equivalent).
• Experience creating and implementing GRC Record of Truth/Tooling.
• Strong policy and standards writing ability.
• Experience conducting and managing product & enterprise risk assessments.
• Proven ability to manage and communicate with senior stakeholders.
• Bachelor’s degree in Information Security, Computer Science, Business, or a related field; equivalent practical experience considered.

Nice to have

• CISSP
• CISM
• CRISC
• CISA
• CCSP
• comparable credentials

Benefits

• Medical, dental, and vision plans
• Wellbeing Fund - flexible wellness stipend
• Mental Health benefits with covered therapy and coaching
• 401(k) program
• Education & learning stipend
• Flexible vacation time
• Paid parental leave
• Company-wide recharge days each quarter
• Work from home stipend

About the company

Gong harnesses the power of AI to transform how revenue teams win. The Gong Revenue AI Operating System unifies data, insights, and workflows into a single, trusted system.