IAM GRC Lead

Nelnet Servicing•Madison, WI

1d•Hybrid

About The Position

The IAM GRC Lead is the Identity & Access Management team’s primary contact and accountable lead for audits, regulatory reviews, and third-party information requests. The role leads the IAM audit program from planning through close, including annual SOC 1 and SOC 2 audits, U.S. Department of Education requirements and reviews related to identity systems, and due-diligence requests from banks, lenders, and other financial institution partners. The lead partners with compliance, internal and external audit, cyber, engineers, and other stakeholders to provide fast, accurate, consistent responses while reducing the audit burden on IAM engineers. The position owns audit-response processes and information management, including a centralized, version-controlled library of approved responses and evidence, standardized workflows, reusable templates, and automated evidence collection. It also maps IAM controls to applicable frameworks and requirements, tracks deadlines and remediation through closure, and reports status to leadership. The position offers a hybrid work option; associates within 30 miles of an office may work remotely for part of the week while maintaining in-office presence. Visa sponsorship is unavailable, and candidates must already be authorized to work in the United States without current or future sponsorship. Security clearance is required. Compensation is $80,000–$110,000 annually, depending on experience.

Requirements

At least 2 years of experience in IT audit, IT compliance, GRC, or security operations, with direct involvement in SOC 1 and/or SOC 2 audits.
Demonstrated ability to lead audit engagements and influence engineers, auditors, and partners without direct authority.
Working knowledge of IAM concepts, including provisioning and deprovisioning, role-based access, privileged access, multi-factor authentication, single sign-on, and user access reviews.
Experience completing security questionnaires or vendor due-diligence requests.
Strong written communication skills and ability to explain technical controls clearly and concisely to auditors and non-technical audiences.
Strong organization skills and a track record of managing multiple requests and deadlines.
Proficiency with Microsoft 365 (Excel, SharePoint, Teams) or similar collaboration tools.
Must already be authorized to work in the United States without the need for current or future visa sponsorship.
Security clearance is required.

Responsibilities

Serve as the IAM team’s primary liaison and audit lead for internal audit, external auditors, compliance, and third-party risk teams during SOC 1 and SOC 2 examinations.
Lead the full IAM audit lifecycle, including planning, kickoff, fieldwork, findings, and close.
Negotiate audit scope, sample sizes, and timelines, and challenge inaccurate or out-of-scope findings or exceptions.
Conduct pre-audit readiness reviews and periodic control self-testing to identify and address gaps.
Receive, triage, and track identity-related requests, including audit PBC lists, control walkthroughs, sample requests, and follow-up questions.
Respond to Department of Education requirements and reviews related to identity systems, authentication, and access controls in coordination with Compliance.
Complete security questionnaires and due-diligence requests from banks and financial institutions, including SIG, CAIQ, and custom questionnaires.
Gather evidence from IAM systems and engineers, verify its completeness and accuracy, and deliver it on time.
Schedule and prepare subject matter experts for auditor walkthroughs and interviews.
Build and maintain a centralized, version-controlled repository of IAM policies, procedures, control narratives, system diagrams, and evidence artifacts.
Map IAM controls to SOC 1/SOC 2 Trust Services Criteria, Department of Education requirements, NIST, FFIEC, GLBA, and customer contractual obligations.
Maintain an audit calendar for recurring deadlines, evidence collection windows, and request due dates.
Track findings, exceptions, and remediation items through closure; hold control owners accountable to committed dates and report status to leadership.
Develop and maintain a library of pre-approved, standardized responses to frequently asked identity questions.
Create templates, playbooks, and reusable evidence packages to reduce response time for repetitive requests.
Partner with IAM engineers to automate recurring evidence collection, such as scheduled access-review reports, user listings, and configuration exports.
Establish review and approval workflows to ensure responses are validated by the appropriate owners before release.
Measure response times and effort, and continuously improve processes to reduce the audit burden on the team.
Review and refresh the response library annually or when systems, policies, or controls change.