Risk & Compliance Engineer Job ID 2026-1824

WebMD • Newark, NJ

7d

About The Position

As a Vendor Risk & Compliance Engineer, you will be uniquely positioned to enhance the Vendor risk program using AI that keeps our vendors and products aligned to frameworks such as NIST, HIPAA, and SOC2. You'll lead and conduct vendor security risk assessments end to end — integrate AI to improve accuracy, evaluate control effectiveness, quantify risk to the business, and partner with risk owners to drive it down. Working under the Sr. Director of Privacy and Compliance, you will also own risk reporting for the team in OneTrust: keeping risk managers accountable for remediation and building the KRIs and KPIs that show leadership how we're trending. Beyond the day-to-day, you'll improve our assessment methodology and questionnaires and maintain them in OneTrust. The ideal candidate demonstrates the ability to continuously identify & integrate AI to improve all aspects of the program, strong and practical GRC fundamentals and the judgment to prioritize real risk reduction over check-the-box control work.

Requirements

• AI Proficiency aiming to improve accuracy and accelerate process improvement
• 4 –6 years leading vendor and third-party risk assessments (security, vendor, HIPAA, etc.) and managing identified risks to resolution. Security Assurance / Assessments experience is also acceptable
• Strong, practical command of risk and control concepts and GRC frameworks — NIST RMF, NIST 800-53r5, and related standards.
• Experience leading discussions with risk owners to develop, negotiate, and close out risk treatment plans.
• Hands-on experience with GRC / risk / compliance tooling (e.g., OneTrust, Archer).
• Experience building and maintaining organizational security risk metrics.
• Strong written and verbal communication and the organizational skills to manage competing deadlines with limited oversight.
• Ability to work independently while fostering cross-functional collaboration, with a consistent customer-first mindset and solid business acumen.
• Bachelor's or advanced degree in a Science, Engineering, Information Systems, or Cybersecurity field (preferred, not required).

Nice To Haves

• Familiarity with AI/agentic systems and emerging AI governance frameworks (e.g., NIST AI RMF, ISO/IEC 42001) — helpful for assessing AI vendors, but not required.
• Relevant certifications (e.g., CISA, CRISC, CISSP, CCSP).

Responsibilities

• Continuous improvement using AI into all aspects of vendor risk management
• Lead and independently prioritize a range of vendor security risk assessments — scoped by service type and integration profile (HIPAA, infrastructure, application, etc.) — to verify compliance with contracts and internal security policies and standards.
• Coordinate vendor information risk activities across procurement, legal, and the business, including assessment criteria and re-assessments, with a focus on SOC 2-dependent vendors.
• Partner with risk owners to design and negotiate risk treatment plans that prioritize genuine risk reduction over check-the-box control enhancements, and track them to closure.
• Lead vendor risk reviews in bi-weekly management meetings to drive accountability for remediation.
• Own risk reporting in OneTrust: ensure risk managers are tracking remediations, and develop and maintain KRIs and KPIs.
• Build, maintain, and improve assessment methodology and questionnaires based on NIST 800-53r5 and the NIST RMF.
• Embed security-by-design into projects and products to mitigate risk before it materializes.
• Support internal assessments and external audits.

Benefits

• Health Insurance (medical, dental, and vision coverage)
• Paid Time Off (including vacation, sick leave, and flexible holiday days)
• 401(k) Retirement Plan with employer matching
• Life and Disability Insurance
• Employee Assistance Program (EAP)
• Commuter and/or Transit Benefits (if applicable)

What This Job Offers

• Job Type: Full-time
• Career Level: Senior