Client & Vendor Risk Leader | InfoSec & Compliance (Hybrid)

KamisPro; Dallas (TX); Hybrid; USD 120,000 - 180,000; Full time

Job summary

KamisPro is seeking an experienced Information Security Client & Vendor Risk Manager to lead the client due diligence program and oversee third-party security assessments. This role requires expertise in security frameworks, risk assessment, regulatory compliance, and stakeholder management.

Hybrid: The role is primarily remote. There will be some days of in-person meetings in Dallas, usually 2 per month, but sometimes extended up to 6 every 4-6 months.

Qualifications

• 6+ years in information security, vendor risk or GRC, ideally in a law firm.
• Strong knowledge of SOC 2, ISO 27001, NIST CSF, HIPAA, GLBA and privacy regs.
• Proven vendor risk assessments and third-party security controls experience.
• Excellent written and verbal communication for executives and non-technical audiences.
• Ability to manage sensitive information and lead cross-functional initiatives.

Responsibilities

• Lead and continuously improve the enterprise-wide client and vendor due diligence program.
• Serve as SME for information security controls during client security reviews and audits.
• Conduct complex vendor security assessments, including SOC 2, ISO 27001 and cloud controls.
• Develop vendor risk processes, risk scoring, onboarding workflows, and monitoring.
• Partner with Procurement, Legal, IT and stakeholders to evaluate contracts and mitigate risk.
• Coordinate responses for client audits and regulatory reviews with cross-functional teams.
• Represent the organization in client security discussions and respond to security questionnaires.
• Monitor emerging cybersecurity threats and evolving privacy regulations.
• Mentor junior team members and contribute to Risk & Compliance growth.
• Drive process improvements to strengthen security posture and client/vendor diligence.

Skills

Information security

Vendor risk management

Regulatory compliance

Stakeholder management

Security frameworks

Executive communication

Job description

KamisPro is seeking an experienced Information Security Client & Vendor Risk Manager to lead the client due diligence program and oversee third-party security assessments. This role requires expertise in security frameworks, risk assessment, regulatory compliance, and stakeholder management.

Hybrid: The role is primarily remote. There will be some days of in-person meetings in Dallas, usually 2 per month, but sometimes extended up to 6 every 4-6 months.