Client Assurance- InfoSec GRC - Remote

Client Assurance and Security Questionnaires

Serve as a primary intake point for client security due diligence, including standardized questionnaires (e.g., SIG, CAIQ), custom due diligence questionnaires, cybersecurity sections of RFPs and RFIs, and topic-specific inquiries such as AI, cloud security, vulnerability management etc.

Triage incoming requests by establishing internal deadlines, setting priorities, routing questions to the appropriate subject matter experts (SMEs), tracking progress, and escalating overdue items.

Draft responses using approved policies, standards, and previously approved content, and route them to SMEs for validation and approval before delivery; help maintain a library of reusable standard responses.

Act as a liaison between clients and Information Security by clarifying questions, managing follow-ups and response timelines, scheduling meetings, and coordinating audit walkthroughs and onsite client visits.

Evidence and Data Management

Collect and organize supporting evidence such as policies, standards, procedures, penetration test summaries, security awareness training attestations, architecture and API documentation, and configuration screenshots.

Coordinate with GRC, Security Operations, Security Architecture, Identity and Access Management (IAM), Infrastructure, Application, and Product teams to obtain accurate responses, evidence, and technical attestations.

Review outgoing evidence before release to confirm appropriate redaction, confidentiality markings, minimum necessary disclosure, and scoping to the client’s request, and elevate questions about sharing sensitive information.

Maintain an organized evidence repository with current, approved artifacts to support consistent and timely responses.

Findings and Audit Support

Track client-identified findings, including audit findings, external security rating findings (e.g., Risk Recon), penetration test findings, and corrective action plans (CAPs); gather updates from remediation owners; and prepare status responses for clients.

Support internal technology audits and control assessments by coordinating evidence requests with control owners, documenting results, and tracking remediation through completion.

Provide occasional support for third-party (vendor) risk assessments as needed.

Reporting and Process Improvement

Maintain centralized trackers and request history that provide accurate visibility into open requests, due dates, findings, and remediation status.

Prepare operational metrics (e.g., request volume, open and aging items, closure timelines) and monthly and quarterly status reports for Information Security leadership.

Maintain standard operating procedures for the client assurance process and identify opportunities to improve efficiency, such as expanding reusable response content and reducing duplicate SME requests.

Build effective working relationships, provide responsive and professional support, maintain confidentiality, and appropriately handle sensitive company, client, employee, security, and risk-related information.

Other activities as may be assigned by your manager

Qualifications/ Requirements:

Bachelor’s or Associate degree in Risk Management, Information Systems, Cybersecurity, Finance, Legal Studies, or a related field, or equivalent combination of education and relevant experience.

Mid-level professional with 2-4 years of industry and/or relevant experience, typically at an Analyst level role or external equivalent, such as information security compliance, client assurance, IT audit, or governance, risk, and compliance (GRC). Experience preferably in the financial services or professional services industry.

Hands-on experience completing or coordinating security questionnaires (e.g., SIG, CAIQ), client audits, or evidence requests, including maintaining trackers and following items through completion.

Working knowledge of core information security domains, including IAM, vulnerability management, application and cloud security, incident response, and security awareness, sufficient to interpret client questions and engage the right SMEs.

Familiarity with common security and assurance frameworks, such as SOC 2, ISO 27001, and NIST CSF.

Strong organizational, analytical, problem-solving, and project coordination skills, with the ability to manage competing priorities and deadlines.

Strong attention to detail and the ability to review documentation and data for completeness and accuracy, identify issues, and…