Remote Client & Vendor Security Risk Manager

KamisPro; Dallas (TX); Hybrid; USD 120,000 - 180,000; Full time

Job summary

KamisPro seeks an Information Security Client & Vendor Risk Manager to lead the client due diligence program and oversee third-party assessments. This role requires expertise in security frameworks, risk, compliance, and stakeholder management, with a preference for law-firm experience.

The position is hybrid: primarily remote with in-person meetings in Dallas, usually 2 per month and up to 6 every 4–6 months, supporting a broad Risk & Compliance function.

Qualifications

• 6+ years of experience in information security, vendor risk management, cybersecurity compliance, or governance, risk, and compliance (GRC) within a Law Firm.
• Strong knowledge of security frameworks and standards, including SOC 2, ISO 27001, NIST Cybersecurity Framework (CSF), HIPAA, GLBA, and applicable privacy regulations.
• Experience leading enterprise vendor risk assessments and evaluating third-party security controls.
• Excellent written and verbal communication skills with the ability to present technical information to executive leadership and non-technical audiences.
• Professional certifications such as CISSP, CISM, CRISC, CISA, CTPRA, or ISO 27001 Lead Implementer/Auditor.

Responsibilities

• Lead and continuously improve the enterprise-wide client and vendor due diligence program.
• Serve as the subject matter expert for information security controls, certifications, and risk posture during client security reviews, audits, RFPs, and contract negotiations.
• Conduct complex vendor security assessments, including reviews of SOC 2 reports, ISO 27001 certifications, penetration testing results, cloud security controls, privacy practices, and data protection measures.
• Develop and maintain vendor risk management processes, including risk scoring methodologies, onboarding workflows, and continuous monitoring.
• Partner with Procurement, Legal, IT, and business stakeholders to evaluate vendor contracts, negotiate security requirements, and recommend risk mitigation strategies.
• Coordinate responses for client audits and regulatory reviews, including evidence collection and cross-functional collaboration.
• Represent the organization in client-facing security discussions and respond to security questionnaires and escalated inquiries.
• Monitor emerging cybersecurity threats, privacy regulations, and industry compliance requirements.
• Mentor junior team members and contribute to the growth of the broader Risk and Compliance function.
• Drive process improvements that enhance efficiency, strengthen security posture, and improve the client and vendor due diligence experience.
• Prepare periodic risk reports and executive briefings for leadership.
• Support additional information security and risk management initiatives as assigned.

Skills

Vendor risk management

Information security

Executive communication

Independent working

Job description

KamisPro seeks an Information Security Client & Vendor Risk Manager to lead the client due diligence program and oversee third-party assessments. This role requires expertise in security frameworks, risk, compliance, and stakeholder management, with a preference for law-firm experience.

The position is hybrid: primarily remote with in-person meetings in Dallas, usually 2 per month and up to 6 every 4–6 months, supporting a broad Risk & Compliance function.