IAM GRC Lead

Nelnet is a diversified and innovative company committed to enriching lives through the power of service as a student loan servicer professional services company consumer loan originator and servicer payments processor renewable energy solutions and K-12 and higher education expert. For over 40 years Nelnet has been serving its customers associates and communities.

The perks of working at Nelnet go beyond our benefits package. When you join the Nelnet team youre part of a community invested in the success of each individual. That support comes through in our work as we are united by our mission of creating opportunities for people where they live learn and work.

The IAM GRC Lead is the Identity & Access Management teams primary point of contact and lead for audits regulatory reviews and third-party information requests. This role leads the teams audit program from planning through close for annual SOC 1 and SOC 2 audits U.S. Department of Education requirements and other third-party clients for identity systems and due-diligence requests from banks lenders and other financial institution partners.

Beyond answering requests this person owns the process: building a centralized library of approved responses and evidence standardizing how the team answers recurring questions and reducing the time and effort engineers spend on audit work. The goal is fast accurate consistent answers every time. This role partners with compliance internal audit external audit cyber and others so every identity related request has one accountable owner.

This position offers a hybrid work option. Nelnet values flexibility and understands the importance of work-life integration. Our hybrid work environment allows associates within 30 miles of an office to work remotely for part of the week while also fostering collaboration and team connection through in-office presence.

Please note that we are unable to provide visa sponsorship for this position. To be considered candidates must already be authorized to work in the United States without the need for current or future sponsorship as security clearance is required.

Compensation range for this role is $80000- $110000 annually depending on experience.

Audit & Request Response

• Serve as the IAM teams primary liaison and audit lead for internal audit external auditors compliance and third-party risk teams during SOC 1 and SOC 2 examinations.

• Lead the full IAM audit lifecycle including planning kickoff fieldwork findings and close.

• Negotiates scope sample sizes and timelines with auditors. Can challenge findings or exceptions that are inaccurate or out of scope.

• Run pre-audit readiness reviews and periodic control self-testing so gaps are found and fixed before auditors find them.

• Receive triage and track all identity-related requests including audit PBC (Provided by Client) lists control walkthroughs sample requests and follow-up questions.

• Respond to Department of Education requirements and reviews related to identity systems authentication and access controls in coordination with Compliance.

• Complete security questionnaires and due-diligence requests from banks and financial institutions (e.g. SIG CAIQ and custom questionnaires) covering identity authentication provisioning and access review practices.

• Gather evidence from IAM systems and engineers verify it is complete and accurate and deliver it on time.

• Schedule and prepare subject matter experts for auditor walkthroughs and interviews.

Information Management

• Build and maintain a centralized version-controlled repository of IAM policies procedures control narratives system diagrams and evidence artifacts.

• Map IAM controls to relevant frameworks and requirements (SOC 1/SOC 2 Trust Services Criteria Department of Education requirements NIST FFIEC GLBA and customer contractual obligations).

• Maintain an audit calendar tracking recurring deadlines evidence collection windows and request due dates.

• Track findings exceptions and remediation items through to closure hold control owners accountable to committed dates and report status to leadership.

Process Efficiency & Standardization

• Develop and maintain a library of pre-approved standardized responses to frequently asked identity questions so answers are uniform across all audiences.

• Identify repetitive requests and create templates playbooks and reusable evidence packages to shorten response time.

• Partner with IAM engineers to automate recurring evidence collection (e.g. scheduled access-review reports user listings configuration exports).

• Establish review and approval workflows so responses are validated by the right owners before release.

• Measure response times and effort and continuously improve the process to reduce audit burden on the team.

• Review and refresh the response library annually or whenever systems policies or controls change.

• 2 years experience in IT audit IT compliance GRC or security operations with direct involvement in SOC 1 and/or SOC 2 audits.

• Demonstrated ability to lead audit engagements and influence engineers auditors and partners without direct authority.

• Working knowledge of identity and access management concepts: provisioning and deprovisioning role-based access privileged access multi-factor authentication single sign-on and user access reviews.

• Experience completing security questionnaires or vendor due-diligence requests.

• Strong written communication skills with the ability to explain technical controls clearly and concisely to auditors and non-technical audiences.

• Highly organized with a track record of managing many requests and deadlines at once.

• Proficiency with Microsoft 365 (Excel SharePoint Teams) or similar collaboration tools.

• Attention to Detail: Ensures every response and piece of evidence is accurate and complete.

• Process Improvement: Spots repetitive work and turns it into repeatable efficient processes.

• Relationship Building: Works effectively with engineers auditors compliance and external partners.

• Ownership: Drives requests to completion and follows up without being asked.

• Discretion: Handles sensitive security information appropriately.

• Influence: Leads auditors engineers and partners to outcomes without direct authority.

• Audit and questionnaire requests completed on or before deadlines.

• Reduction in average response time for recurring requests.

• Percentage of requests answered from the standardized response library.

• Reduction in IAM engineer hours spent on audit support.

• No audit findings caused by incomplete or inaccurate evidence.

• Remediation items closed by the committed date.

• Percentage of recurring evidence collected through automation.
  
  
  

#LI-Hybrid

#LI-CW1

Our benefits package includes medical dental vision HSA and FSA generous earned time off 401K/student loan repayment life insurance & AD&D insurance employee assistance program employee stock purchase program tuition reimbursement performance-based incentive pay short- and long-term disability and a robust wellness program. Click here to learn more about our benefits: Benefits & Perks - Nelnet Inc.

Nelnet is committed to providing a welcoming and respectful workplace where all associates have the opportunity to succeed. As an Equal Opportunity Employer we ensure that all qualified applicants are considered for employment. Employment decisions are made without regard to race color religion/creed national origin gender sex marital status age disability use of a guide dog or service animal sexual orientation military/veteran status or any other status protected by federal state or local law. We value the unique contributions of every team member and believe that a positive work environment benefits everyone.

Qualified individuals with disabilities who require reasonable accommodations in order to apply or compete for positions at Nelnet may request such accommodations by contacting Talent Acquisition at

Nelnet is a Drug Free and Tobacco Free Workplace.

Use of Artificial Intelligence in Hiring

We may use automated or artificial intelligence enabled tools to assist with the initial review of applications such as identifying relevant skills or experience. These tools are used to support human review and do not make hiring decisions. A recruiter reviews applications and determines which candidates move forward in the hiring process. For more information see our Privacy Policy and Pre-Use Notice: Automated Tools in Hiring