Cybersecurity Associate

Our Story

Founded in 2008, Hightower is a wealth management firm that provides investment, financial and retirement planning services to individuals, foundations and family offices, as well as 401(k) consulting and cash management services to corporations. Hightower’s capital solutions, operational support services, size and scale empower its vibrant community of independent-minded wealth advisors to grow their businesses and help their clients achieve their financial vision.

Based in Chicago with advisors across the U.S., we operate as a registered investment advisor (RIA).

Your Future Team

Hightower’s Cybersecurity team delivers exceptional service by securing the company’s information assets, developing and implementing robust security procedures, and ensuring compliance with industry regulations. You will collaborate with cross-functional teams, managed service providers, vendors, and business stakeholders to protect the organization's information assets and strengthen its overall security posture. Responsibilities include supporting security investigations, conducting cybersecurity and vendor risk assessments, maintaining the cybersecurity risk register, tracking remediation activities, assisting with audits and compliance initiatives, and preparing risk and security reporting for management.

Additionally, you will participate in security reviews of new technologies, applications, and business initiatives, support security awareness efforts, and help ensure the effective implementation and maintenance of cybersecurity governance, risk, and compliance programs. This position involves regular interaction with internal stakeholders and external partners to promote a strong culture of cybersecurity risk management across the organization.

What You’ll Do

Cybersecurity Risk Management

• Conduct cybersecurity risk assessments to identify and evaluate risks to the organization's information assets and business operations, document assessment results, and track risk mitigation efforts through remediation or formal risk acceptance.
• Monitor remediation activities and collaborate with stakeholders to ensure timely mitigation of identified risks.
• Assist with risk exception and risk acceptance processes, including documentation and management approvals.
• Monitor cybersecurity risk metrics and key performance indicators and prepare reports for management and leadership.
• Collaborate with cross-functional teams to promote effective cybersecurity risk management practices across the organization.
• Participate in security reviews for new technologies, applications, cloud services, and business initiatives to identify and mitigate potential risks.

Third-Party Risk Management

• Conduct third-party and vendor cybersecurity risk assessments to evaluate security controls and identify potential risks to the organization.
• Support vendor due diligence, onboarding reviews, periodic reassessments, and ongoing risk monitoring activities.
• Evaluate vendor security documentation, including SOC reports, security questionnaires, penetration testing results, and other assurance artifacts.
• Work with internal stakeholders and external vendors to track remediation of identified security gaps and risks.
• Liaise with managed services providers, cloud vendors, and third parties to ensure their security practices align with the company's cybersecurity and risk management objectives.

Governance, Risk, and Compliance (GRC)

• Assist with the development, implementation, and maintenance of cybersecurity policies, standards, procedures, and governance initiatives.
• Support internal and external audits by collecting evidence, coordinating stakeholder responses, and tracking corrective actions to completion.
• Help ensure compliance with applicable…