Client Assurance- InfoSec GRC - Remote

Remote

Remote

Full time

JR03261

SitusAMC is where the best and most passionate people come to transform our client’s businesses and their own careers. Whether you’re a real estate veteran, a passionate technologist, or looking to get your start, join us as we work together to realize opportunities for everyone, we proudly serve.

At SitusAMC, we are looking to match your unique experience with one of our amazing careers, so that we can help you realize your potential and career growth within the Real Estate Industry. If you are someone who can be yourself, advocate for others, stay nimble, dream big, own every outcome, and think global but act local – come join our team!

This role serves as a primary coordinator for customer security inquiries, security questionnaires, due diligence requests, and other client assurance activities within SitusAMC’s Information Security GRC team. The role manages these requests from intake through delivery and supports internal technology audits, control assessments, and the tracking of related findings and remediation. Partnering with Information Security, Product, Technology, Legal, and business teams across regions, this role collects, validates, packages, and delivers accurate cybersecurity and compliance responses while protecting sensitive company information.

This role supports client relationships, contractual obligations, internal policies, and applicable regulatory requirements.

Essential Job Functions:

• Client Assurance and Security Questionnaires
• Serve as a primary intake point for client security due diligence, including standardized questionnaires (e.g., SIG, CAIQ), custom due diligence questionnaires, cybersecurity sections of RFPs and RFIs, and topic-specific inquiries such as AI, cloud security, vulnerability management etc.
• Triage incoming requests by establishing internal deadlines, setting priorities, routing questions to the appropriate subject matter experts (SMEs), tracking progress, and escalating overdue items.
• Draft responses using approved policies, standards, and previously approved content, and route them to SMEs for validation and approval before delivery; help maintain a library of reusable standard responses.
• Act as a liaison between clients and Information Security by clarifying questions, managing follow-ups and response timelines, scheduling meetings, and coordinating audit walkthroughs and onsite client visits.
• Evidence and Data Management
• Collect and organize supporting evidence such as policies, standards, procedures, penetration test summaries, security awareness training attestations, architecture and API documentation, and configuration screenshots.
• Coordinate with GRC, Security Operations, Security Architecture, Identity and Access Management (IAM), Infrastructure, Application, and Product teams to obtain accurate responses, evidence, and technical attestations.
• Review outgoing evidence before release to confirm appropriate redaction, confidentiality markings, minimum necessary disclosure, and scoping to the client’s request, and elevate questions about sharing sensitive information.
• Maintain an organized evidence repository with current, approved artifacts to support consistent and timely responses.
• Findings and Audit Support
• Track client-identified findings, including audit findings, external security rating findings (e.g., Risk Recon), penetration test findings, and corrective action plans (CAPs); gather updates from remediation owners; and prepare status responses for clients.
• Support internal technology audits and control assessments by coordinating evidence requests with control owners, documenting results, and tracking remediation through completion.
• Provide occasional support for third-party (vendor) risk assessments as…