IAM GRC Lead

Nelnet; Madison (WI); Hybrid; USD 80,000 - 110,000; Full time

Benefits offered by this job

Medical

Dental

Vision

HSA/FSA

401K/Student loan repayment

Life Insurance

Employee Assistance Program

Stock Purchase Program

Tuition Reimbursement

Wellness Program

Job summary

Nelnet is seeking an IAM GRC Lead in a hybrid role based in the Madison, WI area. You will own the audit program for identity systems, manage evidence libraries, and coordinate with Compliance and auditors to deliver fast, accurate responses.

You’ll partner with compliance, internal/external audit, and cyber teams to ensure strong controls, timely responses, and continuous improvement of IAM processes. Visa sponsorship is not offered.

Qualifications

• 2+ years experience in IT audit, IT compliance, GRC, or security operations, with direct involvement in SOC 1 and/or SOC 2 audits.
• Demonstrated ability to lead audit engagements and influence engineers, auditors and partners without direct authority.
• Working knowledge of identity and access management concepts: provisioning and deprovisioning, RBAC, privileged access, MFA, SSO, and user access reviews.
• Experience completing security questionnaires or vendor due-diligence requests.
• Strong written communication skills for auditors and non-technical audiences.

Responsibilities

• Serve as the IAM team’s primary liaison and audit lead during SOC 1/SOC 2 examinations.
• Lead the full IAM audit lifecycle from planning to close, including fieldwork and findings.
• Manage scope, sample sizes and timelines with auditors and challenge findings when needed.
• Run pre-audit readiness reviews and self-testing to identify gaps before audits.
• Receive, triage, and track identity-related requests (PBC lists, walkthroughs, sample requests).
• Coordinate responses with Compliance for DoE requirements and other reviews.
• Gather evidence from IAM systems, verify completeness, and deliver on time.
• Schedule experts for auditor walkthroughs and interviews.

Skills

IT audit

GRC

security operations

vendor due-diligence

MS 365

Tools

Microsoft 365 (Excel)

SharePoint

Teams

Job description

Madison, WI

Lincoln, NE

Centennial, CO

Full time

R23282

Nelnet is a diversified and innovative company committed to enriching lives through the power of service as a student loan servicer, professional services company, consumer loan originator and servicer, payments processor, renewable energy solutions, and K-12 and higher education expert. For over 40 years, Nelnet has been serving its customers, associates, and communities.

The perks of working at Nelnet go beyond our benefits package. When you join the Nelnet team, you're part of a community invested in the success of each individual. That support comes through in our work, as we are united by our mission of creating opportunities for people where they live, learn, and work.

The IAM GRC Lead is the Identity & Access Management team’s primary point of contact and lead for audits, regulatory reviews, and third-party information requests. This role leads the team’s audit program from planning through close for annual SOC 1 and SOC 2 audits, U.S. Department of Education requirements and other third-party clients for identity systems, and due-diligence requests from banks, lenders, and other financial institution partners.

Beyond answering requests, this person owns the process: building a centralized library of approved responses and evidence, standardizing how the team answers recurring questions, and reducing the time and effort engineers spend on audit work. The goal is fast, accurate, consistent answers every time. This role partners with compliance, internal audit, external audit, cyber, and others so every identity related request has one accountable owner.

This position offers a hybrid work option. Nelnet values flexibility and understands the importance of work-life integration. Our hybrid work environment allows associates within 30 miles of an office to work remotely for part of the week, while also fostering collaboration and team connection through in-office presence. Please note that we are unable to provide visa sponsorship for this position. To be considered, candidates must already be authorized to work in the United States without the need for current or future sponsorship as security clearance is required.

Compensation range for this role is $80,000- $110,000 annually, depending on experience.

Audit & Request Response

• Serve as the IAM team’s primary liaison and audit lead for internal audit, external auditors, compliance, and third-party risk teams during SOC 1 and SOC 2 examinations.
• Lead the full IAM audit lifecycle, including planning, kickoff, fieldwork, findings, and close.
• Negotiates scope, sample sizes and timelines with auditors. Can challenge findings or exceptions that are inaccurate or out of scope.
• Run pre-audit readiness reviews and periodic control self-testing so gaps are found and fixed before auditors find them.
• Receive, triage, and track all identity-related requests, including audit PBC (Provided by Client) lists, control walkthroughs, sample requests, and follow-up questions.
• Respond to Department of Education requirements and reviews related to identity systems, authentication, and access controls, in coordination with Compliance.
• Complete security questionnaires and due-diligence requests from banks and financial institutions (e.g., SIG, CAIQ, and custom questionnaires) covering identity, authentication, provisioning, and access review practices.
• Gather evidence from IAM systems and engineers, verify it is complete and accurate, and deliver it on time.
• Schedule and prepare subject matter experts for auditor walkthroughs and interviews.

Information Management

• Build and maintain a centralized, version-controlled repository of IAM policies, procedures, control narratives, system diagrams, and evidence artifacts.
• Map IAM controls to relevant frameworks and requirements (SOC 1/SOC 2 Trust Services Criteria, Department of Education requirements, NIST, FFIEC, GLBA, and customer contractual obligations).
• Maintain an audit calendar tracking recurring deadlines, evidence collection windows, and request due dates.
• Track findings, exceptions, and remediation items through to closure, hold control owners accountable to committed dates, and report status to leadership.

Process Efficiency & Standardization

• Develop and maintain a library of pre-approved, standardized responses to frequently asked identity questions so answers are uniform across all audiences.
• Identify repetitive requests and create templates, playbooks, and reusable evidence packages to shorten response time.
• Partner with IAM engineers to automate recurring evidence collection (e.g., scheduled access-review reports, user listings, configuration exports).
• Establish review and approval workflows so responses are validated by the right owners before release.
• Measure response times and effort, and continuously improve the process to reduce audit burden on the team.
• Review and refresh the response library annually, or whenever systems, policies, or controls change.

Required Qualifications

• 2+ years experience in IT audit, IT compliance, GRC, or security operations, with direct involvement in SOC 1 and/or SOC 2 audits.
• Demonstrated ability to lead audit engagements and influence engineers, auditors and partners without direct authority.
• Working knowledge of identity and access management concepts: provisioning and deprovisioning, role-based access, privileged access, multi-factor authentication, single sign-on, and user access reviews.
• Experience completing security questionnaires or vendor due-diligence requests.
• Strong written communication skills, with the ability to explain technical controls clearly and concisely to auditors and non-technical audiences.
• Highly organized, with a track record of managing many requests and deadlines at once.
• Proficiency with Microsoft 365 (Excel, SharePoint, Teams) or similar collaboration tools.

Key Competencies

• Attention to Detail: Ensures every response and piece of evidence is accurate and complete.
• Process Improvement: Spots repetitive work and turns it into repeatable, efficient processes.
• Relationship Building: Works effectively with engineers, auditors, compliance, and external partners.
• Ownership: Drives requests to completion and follows up without being asked.
• Discretion: Handles sensitive security information appropriately.
• Influence: Leads auditors, engineers, and partners to outcomes without direct authority.

Success Measures

• Audit and questionnaire requests completed on or before deadlines.
• Reduction in average response time for recurring requests.
• Percentage of requests answered from the standardized response library.
• Reduction in IAM engineer hours spent on audit support.
• No audit findings caused by incomplete or inaccurate evidence.
• Remediation items closed by the committed date.
• Percentage of recurring evidence collected through automation.

#LI-Hybrid

#LI-CW1

Our benefits package includes medical, dental, vision, HSA and FSA, generous earned time off, 401K/student loan repayment, life insurance & AD&D insurance, employee assistance program, employee stock purchase program, tuition reimbursement, performance-based incentive pay, short- and long-term disability, and a robust wellness program. Click here to learn more about our benefits: Benefits & Perks - Nelnet Inc (https://nelnet.com/careers/benefits-perks/) .

Nelnet is committed to providing a welcoming and respectful workplace where all associates have the opportunity to succeed. As an Equal Opportunity Employer, we ensure that all qualified applicants are considered for employment. Employment decisions are made without regard to race, color, religion/creed, national origin, gender, sex, marital status, age, disability, use of a guide dog or service animal, sexual orientation, military/veteran status, or any other status protected by federal, state, or local law. We value the unique contributions of every team member and believe that a positive work environment benefits everyone.

Qualified individuals with disabilities who require reasonable accommodations in order to apply or compete for positions at Nelnet may request such accommodations by contacting Talent Acquisition at 402-486-5725 or [e-mail].

Nelnet is a Drug Free and Tobacco Free Workplace.

Use of Artificial Intelligence in Hiring

We may use automated or artificial intelligence enabled tools to assist with the initial review of applications, such as identifying relevant skills or experience. These tools are used to support human review and do not make hiring decisions. A recruiter reviews applications and determines which candidates move forward in the hiring process. For more information, see our Privacy Policy and Pre-Use Notice: Automated Tools in Hiring

You may know Nelnet as the nation’s largest student loan servicer – but we do more than that. A lot more. We’re also a professional services company, consumer loan originator and servicer, payment processor, renewable energy innovator, and K-12 and higher education expert (and that’s just a shortlist). For over 40 years, we’ve been serving our customers, associates, and communities to make dreams possible.

EEO Info (https://nelnetinc.com/wp-content/uploads/EEO-poster.pdf) | EEO Letter (https://nelnet.com/wp-content/uploads/EEO-Jeffs-Letter.pdf) | EPPA Info (https://nelnetinc.com/wp-content/uploads/Employee-Polygraph-Protection-Act-Poster.pdf) | FMLA Info (https://nelnetinc.com/wp-content/uploads/FMLA-Leave.pdf) | California Consumer Privacy Notice (https://nelnet.com/california-consumer-privacy-notice/) | Nelnet Applicant Privacy Notice (https://nelnet.com/nelnet-applicant-privacy-notice/) | Notice of Use of Artificial Intelligence and Automated Tools in Hiring (https://nelnet.com/notice-of-use-of-artificial-intelligence-and-automated-tools-in-hiring/) | Canada Applicant Privacy Notice (https://nelnet.com/canada-applicant-privacy-notice/) | EEA Applicant Privacy Notice (https://nelnet.com/eea-applicant-privacy-notice/) | Australia Applicant Privacy Notice (https://nelnet.com/australia-applicant-privacy-notice/)