The posting
Lyra Technology Group is a private equity-backed holding company that invests in and operates industry leading technology service businesses. Our companies are operated independently by exceptional management teams. Companies that join our group retain the employees, name, and culture that have made them successful. As a platform of Evergreen Services Group, we never divest from businesses we partner with and approach every decision with the goal of driving sustainable and healthy growth over the long term.
ImageQuest is looking for an Information Security Advisor to join our Advisory Services team. This role is centered on vendor management: delivering and strengthening ImageQuest's Vendor Management Program for clients, many of them in regulated industries such as banking and healthcare. The Information Security Advisor partners with client advisors to build audit- and exam-ready vendor management programs, provides day-to-day support and quality review for the team's vendor management work, and helps improve our processes through documentation and technology. The ideal candidate is an experienced third-party risk practitioner who is organized, methodical, and detail-oriented, enjoys bringing order out of disorder, and wants to grow into ImageQuest's broader Advisory services over time.
You will own...
Vendor Management Program Delivery
- Develop and maintain the vendor and third-party risk components of each client's Information Security Program, supporting the designated CISO or Information Security Officer as needed.
- Develop and uphold written vendor management policies and procedures, with a focus on new vendor onboarding and ongoing monitoring.
- Partner with clients to initiate due diligence based on their engagement requests, and own the follow-up process through completion.
- Obtain and evaluate vendor documentation, including SOC reports, contracts, and financial statements.
- Classify each vendor based on its potential risk to the client's organization, and document the rationale for each classification.
- Coordinate and execute annual reviews and risk assessments for all critical and selected non-critical vendors, recommending follow-up actions to the appropriate parties.
- Maintain an accurate, up-to-date list of vendors and applications for each client, and keep the vendor management system current for all assigned accounts.
- Prepare Executive Summaries covering vendor performance, compliance status, and areas of concern or improvement.
Exam, Audit & Incident Support
- Assist Principals and Senior Advisors with vendor-related bank exam and audit requests, inquiries, and narratives.
- Recognize when a vendor incident or breach notification needs to be escalated for an assigned client, and escalate it promptly.
- Maintain strong regulatory knowledge, including GLBA, HIPAA, and interagency third-party risk guidance.
Team Support & Quality Oversight
- Serve as the day-to-day point of contact for team members on vendor management questions.
- Coordinate the team's due diligence work, providing guidance to ensure consistent application across client assignments.
- Review vendor management deliverables before they go to clients, and give clear, constructive feedback as a peer.
- Track recurring reviews and flag work at risk of missing a deadline.
- Coordinate with InfoSec Subject Matter Experts to ensure clarity on client assignments and accurate reporting.
Process Improvement
- Help develop and maintain structured vendor management processes and documentation, including use of platforms such as Nvendor.
- Contribute to process improvements using AI and other technologies.
- Participate in process improvement meetings and on-site client focus groups as needed.
Client Service & Collaboration
- Provide first-class client service and maintain a helpful, professional demeanor in all client and employee interactions.
- Respond to emails, phone calls, and Microsoft Teams messages in a timely and efficient manner.
- Participate in on-site client visits, off-site client events, webinars, and training as needed.
- Collaborate with internal departments to meet goals and keep client satisfaction high.
Our ideal Information Security Advisor has the following qualifications:
- 3+ years of hands-on vendor management or third-party risk management experience, including vendor due diligence, risk classification, annual reviews, and evaluation of SOC reports.
- Experience planning and developing policies, procedures, and standards.
- A consultative, risk-based approach to security and process, and the ability and desire to work directly with clients.
- Strong ability to manage a high volume of deliverables across multiple clients with competing deadlines.
- Excellent organizational skills and strong attention to detail.
- Strong analytical and problem-solving skills, with sound initiative, judgment, and discretion.
- Clear, concise written and verbal communication, and a calm, composed demeanor under pressure.
- Ability to work independently on tasks requiring patience, thoroughness, and quality, while working well as part of a team.
- Proficiency with standard business software.
- Bachelor's degree desired; advanced degree a plus.
- Additional information security, IT audit, compliance, or risk management experience is a plus.
- Vendor management experience in a regulated industry (e.g., banking, healthcare, insurance) is a plus.
- Experience with vendor management platforms such as Nvendor/Ncontracts is a plus.
- Knowledge of security concepts related to IT infrastructure is a plus.
- Preferred certifications include CTPRP, CISA, CISM, CISSP, or Security+.
This role is based in Brentwood, TN and will operate on a hybrid basis, with a base compensation range of $88,000-$95,000.
We are looking for someone who takes ownership of the vendor management work from intake through final deliverable, keeps multiple client deadlines on track, and holds every deliverable to a high standard. The right candidate brings order and consistency to a high-volume workflow, raises the quality of the team's work through clear feedback, and looks for practical ways to improve our processes. Once the Vendor Management Program is running consistently, this role offers a defined path to expand into ImageQuest's broader Advisory Services, including vCISO and Information Security Officer programs, risk assessments, policy development, incident response tabletop exercises, and AI risk advisory, supported by shadowing and cross-training.
