Information Security Advisor

Lyra Technology Group•Brentwood, TN

3d•Hybrid

About The Position

Lyra Technology Group is a private equity-backed holding company that invests in and operates technology service businesses. Its companies operate independently and retain the employees, name, and culture that contributed to their success. As part of Evergreen Services Group, Lyra does not divest from partner businesses and focuses on sustainable, long-term growth. ImageQuest is seeking an Information Security Advisor for its Advisory Services team. The role focuses on delivering and strengthening client vendor management programs, particularly for clients in regulated industries such as banking and healthcare. The advisor partners with client advisors to develop audit- and exam-ready programs, supports and quality-checks the team's vendor management work, and improves processes through documentation and technology. The position is suited to an experienced third-party risk practitioner who is organized, methodical, and detail-oriented, and who is interested in expanding into broader advisory work over time. The role owns vendor management program delivery, including developing and maintaining vendor risk components of client information security programs; supporting designated CISOs or Information Security Officers; establishing written policies and procedures; managing vendor due diligence and follow-up; evaluating vendor documentation; classifying vendor risk; coordinating annual reviews and risk assessments; maintaining vendor and application inventories and management systems; and preparing executive summaries. The advisor also supports vendor-related exams, audits, and incidents; maintains regulatory knowledge; provides day-to-day guidance and quality oversight to team members; tracks deadlines; coordinates with information security subject matter experts; and contributes to process improvement, including the use of platforms such as Nvendor and technologies such as AI. The role requires professional, responsive client service and collaboration with internal teams, as well as participation in client visits, events, webinars, and training as needed. The position is based in Brentwood, Tennessee, and operates on a hybrid basis. Base compensation is $86,000–$90,000. Once the Vendor Management Program is operating consistently, the role offers a defined path to broader ImageQuest Advisory Services, including vCISO and Information Security Officer programs, risk assessments, policy development, incident response tabletop exercises, and AI risk advisory, supported by shadowing and cross-training.

Requirements

At least 3 years of hands-on vendor management or third-party risk management experience, including vendor due diligence, risk classification, annual reviews, and evaluation of SOC reports.
Experience planning and developing policies, procedures, and standards.
A consultative, risk-based approach to security and processes, and ability and willingness to work directly with clients.
Ability to manage a high volume of deliverables across multiple clients with competing deadlines.
Strong organizational skills and attention to detail.
Strong analytical and problem-solving skills, with sound initiative, judgment, and discretion.
Clear, concise written and verbal communication and a calm, composed demeanor under pressure.
Ability to work independently on tasks requiring patience, thoroughness, and quality, while also working well as part of a team.
Proficiency with standard business software.

Nice To Haves

Bachelor's degree desired; an advanced degree is a plus.
Additional information security, IT audit, compliance, or risk management experience.
Vendor management experience in a regulated industry such as banking, healthcare, or insurance.
Experience with vendor management platforms such as Nvendor/Ncontracts.
Knowledge of security concepts related to IT infrastructure.
Preferred certifications include CTPRP, CISA, CISM, CISSP, or Security+.

Responsibilities

Develop and maintain vendor and third-party risk components of each client's Information Security Program, supporting the designated CISO or Information Security Officer as needed.
Develop and uphold written vendor management policies and procedures, particularly for new vendor onboarding and ongoing monitoring.
Initiate vendor due diligence based on client engagement requests and manage follow-up through completion.
Obtain and evaluate vendor documentation, including SOC reports, contracts, and financial statements.
Classify vendors according to potential organizational risk and document the rationale for each classification.
Coordinate and conduct annual reviews and risk assessments for critical and selected non-critical vendors, recommending follow-up actions.
Maintain accurate client vendor and application inventories and keep vendor management systems current for assigned accounts.
Prepare executive summaries covering vendor performance, compliance status, and areas of concern or improvement.
Assist Principals and Senior Advisors with vendor-related bank examination and audit requests, inquiries, and narratives.
Recognize vendor incidents or breach notifications requiring escalation and escalate them promptly for assigned clients.
Maintain knowledge of relevant regulations and guidance, including GLBA, HIPAA, and interagency third-party risk guidance.
Act as the day-to-day point of contact for team members' vendor management questions and coordinate due diligence work across client assignments.
Guide team members to support consistent application of vendor management practices across assignments.
Review vendor management deliverables before they are sent to clients and provide clear, constructive peer feedback.
Track recurring reviews and flag work that may miss deadlines.
Coordinate with Information Security Subject Matter Experts to clarify client assignments and ensure accurate reporting.
Help develop and maintain structured vendor management processes and documentation, including use of platforms such as Nvendor.
Contribute to process improvements using AI and other technologies; participate in process improvement meetings and on-site client focus groups as needed.
Provide professional, helpful client service and respond to emails, phone calls, and Microsoft Teams messages in a timely and efficient manner.
Participate in on-site client visits, off-site client events, webinars, and training as needed.
Collaborate with internal departments to meet goals and maintain high client satisfaction.
Potentially expand into broader Advisory Services, including vCISO and Information Security Officer programs, risk assessments, policy development, incident response tabletop exercises, and AI risk advisory, with shadowing and cross-training.