Develop and uphold written vendor management policies and procedures, with a focus on new vendor onboarding and ongoing monitoring.
Partner with clients to initiate due diligence based on their engagement requests, and own the follow-up process through completion.
Obtain and evaluate vendor documentation, including SOC reports, contracts, and financial statements.
Classify each vendor based on its potential risk to the client's organization, and document the rationale for each classification.
Coordinate and execute annual reviews and risk assessments for all critical and selected non-critical vendors, recommending follow-up actions to the appropriate parties.
Maintain an accurate, up-to-date list of vendors and applications for each client, and keep the vendor management system current for all assigned accounts.
Prepare Executive Summaries covering vendor performance, compliance status, and areas of concern or improvement.
Exam, Audit & Incident Support
Assist Principals and Senior Advisors with vendor-related bank exam and audit requests, inquiries, and narratives.
Recognize when a vendor incident or breach notification needs to be escalated for an assigned client, and escalate it promptly.
Maintain strong regulatory knowledge, including GLBA, HIPAA, and interagency third-party risk guidance.
Team Support & Quality Oversight
Serve as the day-to-day point of contact for team members on vendor management questions.
Coordinate the team's due diligence work, providing guidance to ensure consistent application across client assignments.
Review vendor management deliverables before they go to clients, and give clear, constructive feedback as a peer.
Track recurring reviews and flag work at risk of missing a deadline.
Coordinate with InfoSec Subject Matter Experts to ensure clarity on client assignments and accurate reporting.
Process Improvement
Help develop and maintain structured vendor management processes and documentation, including use of platforms such as Nvendor.
Contribute to process improvements using AI and other technologies.
Participate in process improvement meetings and on-site client focus groups as needed.
Client Service & Collaboration
Provide first-class client service and maintain a helpful, professional demeanor in all client and employee interactions.
Respond to emails, phone calls, and Microsoft Teams messages in a timely and efficient manner.
Participate in on-site client visits, off-site client events, webinars, and training as needed.
Collaborate with internal departments to meet goals and keep client satisfaction high.
Our ideal Information Security Advisor has the following qualifications:
3+ years of hands-on vendor management or third-party risk management experience, including vendor due diligence, risk classification, annual reviews, and evaluation of SOC reports.
Experience planning and developing policies, procedures, and standards.
A consultative, risk-based approach to security and process, and the ability and desire to work directly with clients.
Strong ability to manage a high volume of deliverables across multiple clients with competing deadlines.
Excellent organizational skills and strong attention to detail.
Strong analytical and problem-solving skills, with sound initiative, judgment, and discretion.
Clear, concise written and verbal communication, and a calm, composed demeanor under pressure.
Ability to work independently on tasks requiring patience, thoroughness, and quality, while working well as part of a team.
Proficiency with standard business software.
Bachelor's degree desired; advanced degree a plus.
Additional information security, IT audit, compliance, or risk management experience is a plus.
Vendor management experience in a regulated industry (e.g., banking, healthcare, insurance) is a plus.
Experience with vendor management platforms such as Nvendor/Ncontracts is a plus.
Knowledge of security concepts related to IT infrastructure is a plus.
Preferred certifications include CTPRP, CISA, CISM, CISSP, or Security+.
This role is based in Brentwood, TN and will operate on a hybrid basis, with a base compensation range of $88,000-$95,000.
We are looking for someone who takes ownership of the vendor management work from intake through final deliverable, keeps multiple client deadlines on track, and holds every deliverable to a high standard. The right candidate brings order and consistency to a high-volume workflow, raises the quality of the team's work through clear feedback, and looks for practical ways to improve our processes. Once the Vendor Management Program is running consistently, this role offers a defined path to expand into ImageQuest's broader Advisory Services, including vCISO and Information Security Officer programs, risk assessments, policy development, incident response tabletop exercises, and AI risk advisory, supported by shadowing and cross-training.
