Client Assurance- InfoSec GRC

Accountabilities:: Manage client assurance requests: Coordinate incoming security questionnaires, due diligence assessments, cybersecurity-related RFPs and RFIs, and specialized inquiries covering topics such as cloud security, AI governance, and vulnerability management. Coordinate response workflows: Prioritize requests, establish deadlines, assign questions to subject matter experts, monitor progress, follow up on outstanding items, and escalate delays when necessary. Prepare and validate security responses: Draft clear, accurate answers using approved policies, standards, and existing content, ensuring all responses receive the appropriate technical review and approval before delivery. Manage security evidence and documentation: Collect, organize, and maintain supporting materials, including policies, procedures, penetration testing summaries, security training records, architecture documentation, API information, and configuration evidence. Protect sensitive information: Review documentation before sharing to ensure appropriate redaction, confidentiality markings, and minimum necessary disclosure, escalating concerns about sensitive data when required. Support audits and remediation tracking: Coordinate internal technology audits and control assessments, document findings, monitor corrective action plans, and follow up with remediation owners until issues are resolved. Monitor client-identified findings: Track audit observations, external security ratings, penetration testing findings, and other risk-related issues while preparing accurate status updates for clients. Maintain reporting and operational visibility: Keep centralized trackers and evidence repositories up to date, monitor request volumes and completion timelines, and prepare monthly and quarterly reports for Information Security leadership. Improve processes and collaboration: Maintain standard operating procedures, expand reusable response libraries, reduce repetitive requests to technical teams, and build effective working relationships across departments and regions. Provide additional GRC support: Contribute to third-party risk assessments and other information security initiatives as needed, while maintaining professional communication and strict confidentiality. Requirements: Education: Associate or bachelor's degree in Risk Management, Information Systems, Cybersecurity, Finance, Legal Studies, or a related discipline, or an equivalent combination of education and relevant professional experience. Professional experience: Approximately 2–4 years of relevant experience in information security compliance, client assurance, IT audit, governance, risk, and compliance (GRC), or a comparable analytical role. Experience in financial services or professional services is preferred. Client assurance expertise: Practical experience completing or coordinating security questionnaires, such as SIG or CAIQ, managing client audits, collecting evidence, maintaining request trackers, and ensuring deliverables are completed on time. Information security knowledge: Working knowledge of key security domains, including identity and access management (IAM), vulnerability management, application and cloud security, incident response, and security awareness. Framework familiarity: Understanding of established security and assurance frameworks, particularly SOC 2, ISO 27001, and the NIST Cybersecurity Framework. Organizational and analytical skills: Strong attention to detail, critical thinking, problem-solving, and project coordination abilities, with the capacity to manage multiple requests, competing priorities, and tight deadlines. Communication and stakeholder management: Excellent written and verbal communication skills, including the ability to translate technical information into clear, client-friendly responses and collaborate effectively with technical and non-technical stakeholders across different organizational levels and geographic regions. Reporting and technical proficiency: Proficiency in Microsoft Excel, Word, and PowerPoint, with experience preparing operational reports, dashboards, management updates, and supporting documentation. Professional judgment and confidentiality: Ability to work independently within established policies and controls, assess documentation for completeness and accuracy, identify potential issues, escalate concerns appropriately, and handle sensitive client, employee, security, and risk information responsibly. Preferred qualifications: Industry certifications such as CompTIA Security+, CISA, or ISO/IEC 27001 Lead Auditor or Lead Implementer, or active progress toward a relevant certification. Familiarity with financial services regulatory and compliance expectations, including FFIEC guidance, the Gramm-Leach-Bliley Act (GLBA), and NYDFS Cybersecurity Regulation (23 NYCRR 500). Experience using GRC, security questionnaire automation, or trust center platforms such as Optro, UpGuard, ServiceNow, OneTrust, Whistic, or SafeBase. Exposure to AI governance-related client inquiries and third-party or vendor risk assessments. Benefits: Annual base salary: $70,000–$85,000, depending on relevant experience, education, skills, training, geographic location, and market conditions. Potential bonus: Eligibility for a discretionary bonus may apply depending on the position, applicable bonus program guidelines, and management approval. Remote work: Fully remote position based in the United States. Paid time off: Paid time off (PTO) and paid holidays, subject to applicable company policies. Healthcare coverage: Access to medical, dental, and vision insurance plans. Financial protection: Life insurance and disability insurance options. Retirement planning: Access to a 401(k) retirement savings plan. Professional development: Opportunities to expand expertise in cybersecurity assurance, governance, risk management, compliance, and audit coordination through hands-on experience and cross-functional collaboration.