Client Assurance- InfoSec GRC - Remote US

SitusAMC; Helena (MT); A distancia; USD 70.000 - 85.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

PTO and paid holidays

Medical, dental, vision, life, and 401

Descripción de la vacante

SitusAMC is seeking a mid-level Information Security/Client Assurance professional to lead and coordinate responses for client due diligence, questionnaires, and audit evidence. You will work with GRC, IAM, Security Ops, and product teams to gather, validate, and deliver accurate attestations in a timely manner.

Ideal candidates bring 2–4 years in information security compliance or client assurance, experience with SIG/CAIQ, and familiarity with SOC 2, ISO 27001, and NIST CSF, plus strong

Formación

• Bachelor’s or Associate degree in Risk Management, Information Systems, Cybersecurity, Finance, Legal Studies, or related field, or equivalent combination of education and relevant experience.
• 2-4 years of industry and/or relevant experience at Analyst level in information security compliance, client assurance, IT audit, or GRC.
• Hands-on experience coordinating security questionnaires (e.g., SIG, CAIQ) and client audits.
• Working knowledge of IAM, vulnerability management, application and cloud security, incident response, and security awareness.
• Familiarity with SOC 2, ISO 27001, and NIST CSF.
• Strong organizational, analytical, problem-solving, and project coordination skills.
• Strong written and verbal communication for technical audiences and cross-functional teams.
• Proficiency with Microsoft Office (Excel, Word, PowerPoint).
• Experience preparing reports, dashboards, status updates, and management documentation.
• Ability to work independently within policies and maintain confidentiality.
• Preferred certifications such as CompTIA Security+, CISA, or ISO/IEC 27001 Lead Auditor/Implementer.
• Familiarity with financial services regulatory expectations for information security and third-party risk.
• Experience with GRC, questionnaire automation, or trust center platforms (Optro, UpGuard, ServiceNow, OneTrust, Whistic, SafeBase).
• Exposure to AI governance inquiries or third-party risk assessments.

Responsabilidades

• Serve as primary intake for client security due diligence and questionnaires (SIG, CAIQ, RFP/RFI sections).
• Triage requests, set deadlines, route to SMEs, track progress, and escalate overdue items.
• Draft responses using approved content; maintain a library of reusable responses.
• Act as liaison between clients and Information Security to clarify questions and coordinate timelines.
• Collect and organize evidence (policies, standards, testing results, documentation).
• Coordinate with GRC, Security Ops, IAM, Infrastructure, and product teams for accurate responses and attestations.
• Review outgoing evidence for redaction and confidentiality before release.
• Maintain an organized evidence repository of approved artifacts for timely responses.
• Track findings from audits, external ratings, and CAPs; prepare status updates for clients.
• Support audits and control assessments by coordinating evidence requests and documenting results.
• Provide occasional support for third-party risk assessments as needed.
• Maintain trackers and SOPs; improve efficiency by expanding reusable content.

Conocimientos

Attention to detail

Strong communication

Project coordination

Time management

Analytical thinking

Educación

Bachelor’s or Associate degree in Risk Management

Herramientas

Excel

Word

PowerPoint

Descripción del empleo

Essential Job Functions:

• Client Assurance and Security Questionnaires

• Serve as a primary intake point for client security due diligence, including standardized questionnaires (e.g., SIG, CAIQ), custom due diligence questionnaires, cybersecurity sections of RFPs and RFIs, and topic-specific inquiries such as AI, cloud security, vulnerability management etc.

• Triage incoming requests by establishing internal deadlines, setting priorities, routing questions to the appropriate subject matter experts (SMEs), tracking progress, and escalating overdue items.

• Draft responses using approved policies, standards, and previously approved content, and route them to SMEs for validation and approval before delivery; help maintain a library of reusable standard responses.

• Act as a liaison between clients and Information Security by clarifying questions, managing follow-ups and response timelines, scheduling meetings, and coordinating audit walkthroughs and onsite client visits.

• Evidence and Data Management

• Collect and organize supporting evidence such as policies, standards, procedures, penetration test summaries, security awareness training attestations, architecture and API documentation, and configuration screenshots.

• Coordinate with GRC, Security Operations, Security Architecture, Identity and Access Management (IAM), Infrastructure, Application, and Product teams to obtain accurate responses, evidence, and technical attestations.

• Review outgoing evidence before release to confirm appropriate redaction, confidentiality markings, minimum necessary disclosure, and scoping to the client’s request, and elevate questions about sharing sensitive information.

• Maintain an organized evidence repository with current, approved artifacts to support consistent and timely responses.

• Findings and Audit Support

• Track client-identified findings, including audit findings, external security rating findings (e.g., RiskRecon), penetration test findings, and corrective action plans (CAPs); gather updates from remediation owners; and prepare status responses for clients.

• Support internal technology audits and control assessments by coordinating evidence requests with control owners, documenting results, and tracking remediation through completion.

• Provide occasional support for third-party (vendor) risk assessments as needed.

• Reporting and Process Improvement

• Maintain centralized trackers and request history that provide accurate visibility into open requests, due dates, findings, and remediation status.

• Prepare operational metrics (e.g., request volume, open and aging items, closure timelines) and monthly and quarterly status reports for Information Security leadership.

• Maintain standard operating procedures for the client assurance process and identify opportunities to improve efficiency, such as expanding reusable response content and reducing duplicate SME requests.

• Build effective working relationships, provide responsive and professional support, maintain confidentiality, and appropriately handle sensitive company, client, employee, security, and risk-related information.

• Other activities as may be assigned by your manager

• Qualifications/ Requirements:

• Bachelor’s or Associate degree in Risk Management, Information Systems, Cybersecurity, Finance, Legal Studies, or a related field, or equivalent combination of education and relevant experience.

• Mid-level professional with 2-4 years of industry and/or relevant experience, typically at an Analyst level role or external equivalent, such as information security compliance, client assurance, IT audit, or governance, risk, and compliance (GRC). Experience preferably in the financial services or professional services industry.

• Hands-on experience completing or coordinating security questionnaires (e.g., SIG, CAIQ), client audits, or evidence requests, including maintaining trackers and following items through completion.

• Working knowledge of core information security domains, including IAM, vulnerability management, application and cloud security, incident response, and security awareness, sufficient to interpret client questions and engage the right SMEs.

• Familiarity with common security and assurance frameworks, such as SOC 2, ISO 27001, and NIST CSF.

• Strong organizational, analytical, problem-solving, and project coordination skills, with the ability to manage competing priorities and deadlines.

• Strong attention to detail and the ability to review documentation and data for completeness and accuracy, identify issues, and elevate concerns appropriately.

• Strong written and verbal communication skills, including the ability to write clear, accurate responses for client audiences, translate technical information for non-technical stakeholders, and work professionally across functions, organizational levels, and geographic regions.

• Proficiency with Microsoft Office, specifically Excel, Word, and PowerPoint.

• Experience preparing reports, dashboards, status updates, and management documentation.

• Ability to work independently within established policies, procedures, and controls; exercise sound judgment; recognize when guidance or escalation is needed; and maintain confidentiality when handling sensitive information.

• Preferred Qualifications

• Industry certification such as CompTIA Security+, CISA, or ISO/IEC 27001 Lead Auditor or Lead Implementer, or progress toward one.

• Familiarity with financial services regulatory expectations for information security and third-party risk (e.g., FFIEC, GLBA, NYDFS Part 500).

• Experience with GRC, questionnaire automation, or trust center platforms (e.g., Optro, UpGuard, ServiceNow, OneTrust, Whistic, SafeBase).

• Exposure to AI governance inquiries or third-party (vendor) risk assessments.

#LI-AS1 #LI-Remote

Note: This job description is not intended to be all inclusive or exclusive. At any time, employees may perform other related duties as required to meet the ongoing needs of the organization and participate in additional trainings. SitusAMC does not accept unsolicited resumes from staffing agencies, search firms or any third parties. Any unsolicited resume submitted to SitusAMC in any manner will be considered SitusAMC property, and SitusAMC will not pay a fee for any placement resulting from the receipt of an unsolicited resume.

The annual full time base salary range for this role is

$70,000.00 - $85,000.00

Specific compensation is determined through interviews and a review of relevant education, experience, training, skills, geographic location and alignment with market data. Additionally, certain positions may be eligible to receive a discretionary bonus as determined by bonus program guidelines, position eligibility and SitusAMC Senior Management approval. SitusAMC offers PTO and paid holidays, the terms of which are set forth in the program policies. All full time employees also are eligible to participate in various benefit plans, including medical, dental, vision, life, disability insurance and 401K; in each case in accordance with the terms of the applicable plans.

Pay Transparency Nondiscrimination Provision (https://go.situsamc.com/rs/962-QMP-613/images/pay-transp_%20English_formattedESQA508c.pdf?version=0)

SitusAMC is an Equal Opportunity Employer. Qualified applicants will receive consideration for employment without regard to race, color, religion, age, sex, national origin, disability, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws.

Know Your Rights, Workplace Discrimination is Illegal (https://www.eeoc.gov/sites/default/files/2023-06/22-088_EEOC_KnowYourRights6.12ScreenRdr.pdf)