IAM GRC Lead

Nelnet•Lincoln, NE

3d•$80,000 - $110,000•Hybrid

About The Position

The IAM GRC Lead is the Identity & Access Management team’s primary point of contact and lead for audits, regulatory reviews, and third-party information requests. The role owns the IAM audit program from planning through close, including annual SOC 1 and SOC 2 audits, U.S. Department of Education requirements and reviews related to identity systems, and due-diligence requests from banks, lenders, and other financial institution partners. The role builds and maintains a centralized, version-controlled library of approved responses and evidence, standardizes answers to recurring questions, and reduces the time and effort engineers spend on audit work. The IAM GRC Lead partners with compliance, internal audit, external audit, cyber, and other stakeholders to ensure identity-related requests have a clearly accountable owner. This position offers a hybrid work option for associates within 30 miles of an office, with remote work part of the week and in-office presence for collaboration.

Requirements

At least 2 years of experience in IT audit, IT compliance, GRC, or security operations, with direct involvement in SOC 1 and/or SOC 2 audits.
Demonstrated ability to lead audit engagements and influence engineers, auditors, and partners without direct authority.
Working knowledge of identity and access management concepts, including provisioning and deprovisioning, role-based access, privileged access, multi-factor authentication, single sign-on, and user access reviews.
Experience completing security questionnaires or vendor due-diligence requests.
Strong written communication skills and ability to explain technical controls clearly and concisely to auditors and non-technical audiences.
Strong organizational skills and a track record of managing multiple requests and deadlines.
Proficiency with Microsoft 365 (Excel, SharePoint, Teams) or similar collaboration tools.
Must already be authorized to work in the United States without current or future visa sponsorship; security clearance is required.

Responsibilities

Serve as the IAM team’s primary liaison and audit lead for internal audit, external auditors, compliance, and third-party risk teams during SOC 1 and SOC 2 examinations.
Lead the full IAM audit lifecycle, including planning, kickoff, fieldwork, findings, and close.
Negotiate audit scope, sample sizes, and timelines, and challenge findings or exceptions that are inaccurate or out of scope.
Run pre-audit readiness reviews and periodic control self-testing to identify and address gaps before audits.
Receive, triage, and track identity-related requests, including audit PBC lists, control walkthroughs, sample requests, and follow-up questions.
Coordinate responses to Department of Education requirements and reviews related to identity systems, authentication, and access controls.
Complete security questionnaires and due-diligence requests from banks and financial institutions, including SIG, CAIQ, and custom questionnaires.
Gather evidence from IAM systems and engineers, verify its completeness and accuracy, and deliver it on time.
Schedule and prepare subject matter experts for auditor walkthroughs and interviews.
Build and maintain a centralized, version-controlled repository of IAM policies, procedures, control narratives, system diagrams, and evidence artifacts.
Map IAM controls to relevant frameworks and requirements, including SOC 1/SOC 2 Trust Services Criteria, Department of Education requirements, NIST, FFIEC, GLBA, and customer contractual obligations.
Maintain an audit calendar for recurring deadlines, evidence collection windows, and request due dates.
Track findings, exceptions, and remediation items through closure; hold control owners accountable to committed dates and report status to leadership.
Develop and maintain a library of pre-approved, standardized responses to frequently asked identity questions.
Create templates, playbooks, and reusable evidence packages for repetitive requests to shorten response time.
Partner with IAM engineers to automate recurring evidence collection, such as scheduled access-review reports, user listings, and configuration exports.
Establish review and approval workflows so responses are validated by appropriate owners before release.
Measure response times and effort, and improve processes to reduce audit burden on the team.
Review and refresh the response library annually or when systems, policies, or controls change.