GoodRx is the leading prescription savings platform in the U.S. Trusted by more than 25 million consumers and 750,000 healthcare professionals annually, GoodRx provides access to savings and affordability options for generic and brand-name medications at more than 70,000 pharmacies nationwide, as well as comprehensive healthcare research and information. Since 2011, GoodRx has helped consumers save nearly $75 billion on the cost of their prescriptions.Our goal is to help Americans find convenient and affordable healthcare. We offer solutions for consumers, employers, health plans, and anyone else who shares our desire to provide affordable prescriptions to all Americans.About the RoleGoodRx is searching for a Third Party Risk Management Lead to oversee our third party risk management function. Ideal candidates will have experience performing third party risk assessments using industry-standard frameworks and practices such as: SOC2, ISO (27001, 22301, 42001, etc. ), NIST, HITRUST, etc. from vendors, and has experience building and maturing a third party risk management program.Key Responsibilities:Vendor Security Assessments &amp; Third Party Risk Management<ul><li>Conduct thorough third party risk assessments, evaluating their security controls, compliance with industry standards and risks.</li><li>Utilize a GRC platform or similar tools to manage and automate third party risk assessments.</li><li>Evaluate the current third party risk management program, recommend, and implement enhancements in alignment with industry standards.</li><li>Analyze third party assessments, security and compliance reports, identifying gaps and potential risks to the organization.</li><li>Assess data handling, encryption, access controls, incident response and secure software development maturity capabilities as well as other areas of their governance programs in alignment with their specific use cases.</li><li>Issue, track, and review GoodRx third party security questionnaires and their findings, and follow up on remediation efforts to mitigate identified risks.</li></ul>Security Framework &amp; Compliance Analysis<ul><li>Interpret and apply security compliance frameworks such as SOC 2, ISO (27001, 22301, 42001, etc.), NIST 800-53, HiTrust, etc.</li><li>Provide insights and recommendations based on security audits, penetration test reports, and compliance documentation.</li><li>Ensure vendors maintain security controls that align with the organizations policies and regulatory obligations.</li><li>Support security audits by providing vendor risk assessment reports and remediation tracking.</li></ul>Security Tools &amp; Automation<ul><li>Manage and enhance the GRC Platform’s vendor risk management workflows to streamline security assessments.</li><li>Leverage security tools for risk scoring, threat intelligence, and compliance monitoring.</li><li>Continuously improve vendor risk assessment methodologies and security controls.</li></ul>Required Qualifications:<ul><li>5+ years of experience in security risk assessments, vendor security evaluations, or similar compliance roles.</li><li>Strong experience working with OneTrust or similar GRC (Governance, Risk, and Compliance) tools.</li><li>Knowledge of SOC 2 Type II, ISO 27001, NIST 800-53, CIS, and other security frameworks.</li><li>Familiarity with security best practices for cloud services (AWS, Azure, GCP).</li><li>Understanding of third-party risk management (TPRM) processes.</li><li>Experience with reviewing security policies, audit reports, and vendor due diligence documentation.</li><li>Experience with security questionnaires (SIG, CAIQ) and vendor risk scoring methodologies.</li><li>Preferred Qualifications:</li><li>Certifications such as CISA, CISSP, CCSP, ISO 27001 Lead Auditor, CTPRP or CRISC.</li><li>Experience with automating vendor risk processes in OneTrust, Drata, Archer, or ServiceNow.</li><li>Knowledge of third-party cybersecurity risk scoring tools (BitSight, SecurityScorecard, RiskRecon).</li><li>Understanding of supply chain risk management (SCRM) and emerging vendor threats.</li></ul>Soft Skills:<ul><li>Strong communication skills to collaborate with vendors, security teams, and stakeholders.</li><li>Detail-oriented mindset to analyze compliance documentation and identify security gaps.</li></ul><h2></h2>Engineering teams are responsible for supporting appropriate security controls, including management, operational, and technical controls in addition to general GoodRx best practices, such as reading and adhering to the security policies and procedures, being vigilant and observant of potential security threats, etc.At GoodRx, pay ranges are determined based on work locations and may vary based on where the successful candidate is hired. The pay ranges below are shown as a guideline, and the successful candidate’s starting pay will be determined based on job-related skills, experience, qualifications, and other relevant business and organizational factors. These pay zones may be modified in the future. Please contact your recruiter for additional information.San Francisco and Seattle Offices:$151,000.00 - $242,000.00New York Office:$139,000.00 - $222,000.00Santa Monica Office:$126,000.00 - $202,000.00Other Office Locations:$113,000.00 - $182,000.00GoodRx also offers additional compensation programs such as annual cash bonuses or commission, and annual equity grants for most positions as well as generous benefits. Our great benefits offerings include medical, dental, and vision insurance, 401(k) with a company match, an ESPP, unlimited vacation, 13 paid holidays, and 72 hours of sick leave. GoodRx also offers additional benefits like mental wellness and financial wellness programs, fertility benefits, generous parental leave, pet insurance, supplemental life insurance for you and your dependents, company-paid short-term and long-term disability, and more!We’re committed to growing and empowering a more inclusive community within our company and industry. That’s why we hire and cultivate diverse teams of the best and brightest from all backgrounds, experiences, and perspectives. We believe that true innovation happens when everyone has a seat at the table and the tools, resources, and opportunities to excel.With that said, research shows that women and other underrepresented groups apply only if they meet 100% of the criteria. GoodRx is committed to leveling the playing field, and we encourage women, people of color, those in the LGBTQ+ communities, individuals with disabilities, and Veterans to apply for positions even if they don’t necessarily check every box outlined in the job description. Please still get in touch - we’d love to connect and see if you could be good for the role!GoodRx is committed to providing reasonable accommodations for candidates with disabilities during our recruiting process. If you need any assistance or accommodations due to a disability, please reach out to us at <a href="mailto:accommodations@goodrx.com" target="_blank">accommodations@goodrx.com</a>.We prioritize candidate safety. Please be aware that all official communication will only be sent from @goodrx.com or goodrx@myworkday.com addresses.GoodRx is Americas healthcare marketplace. The company offers the most comprehensive and accurate resource for affordable prescription medications in the U.S., gathering pricing information from thousands of pharmacies coast to coast, as well as a tele-health marketplace for online doctor visits and lab tests. Since 2011, Americans with and without health insurance have saved $60 billion using GoodRx and million consumers visit <a href="http://goodrx.com/" target="_blank">goodrx.com</a> each month to find discounts and information related to their healthcare. GoodRx is the #1 most downloaded medical app on the iOS and Android app stores. For more information, visit <a href="http://www.goodrx.com/" target="_blank">www.goodrx.com</a>.