Baker Botts LLP

Client & Vendor Risk Manager

Baker Botts LLP • $110K — $130K *
Dallas, TX 75217In-Person
Legal & Accounting
5 - 7 years of experience
Today
Be an Early Applicant
Job Overview by Ladders

Qualifications

  • 6+ years in information security, vendor risk management, compliance, or legal operations in a regulated setting, preferably Am Law 200.
  • In-depth knowledge of security frameworks: SOC 2, ISO 27001, NIST CSF, HIPAA, GLBA, and state privacy laws.
  • Experience in leading vendor-risk assessments for enterprise technology providers.
  • Strong communication skills for technical and non-technical audiences, including briefing partners and client interactions.
  • Proven capability to manage sensitive data and lead cross-functional initiatives under pressure.
  • Certifications: CTPRA, ISO 27001 Lead Implementer/Auditor, and CISSP, CISM, CRISC, or CISA are required.
  • Familiarity with legal-industry technologies such as DMS and cloud-based practice-management tools is advantageous.

Responsibilities

  • Own and mature the firm-wide client and vendor due diligence program ensuring compliance with regulatory standards.
  • Serve as the subject-matter expert on information security controls during audits and reviews.
  • Lead complex vendor-risk assessments for key technology and service providers.
  • Develop and maintain the firm's vendor-risk management framework, including risk-scoring and onboarding processes.
  • Collaborate with Procurement, IT, and Legal to negotiate security requirements and recommend risk mitigation.
  • Prepare for client audits and regulatory reviews, coordinating evidence collection and documentation.
  • Act as a representative in client-facing security discussions, addressing inquiries from security teams and corporate counsel.
  • Monitor emerging risks and regulatory changes relevant to the legal sector.
  • Mentor junior analysts and support the development of the Risk and Compliance team.

Benefits

  • Full-time remote work with the flexibility to attend occasional in-office meetings as needed.
  • Potential for travel for team meetings and onsite assessments when required.
  • Access to a supportive environment that encourages professional growth and training for security-related certifications.
Full Job Description
ABOUT THE ROLE

The Information Security Client & Vendor Risk Manager leads the firm's client due diligence program and oversees all information security vetting for third party vendors across the firm. This role requires deep expertise in security frameworks, strong risk-assessment judgment, and the ability to influence senior stakeholders, including internal stakeholders, and client security teams. The Manager acts as a key liaison between the firm's clients, internal leadership, IT Security, Procurement, and Risk Management, ensuring the firm meets the heightened expectations of our clients.

WHAT YOU'LL DO

Primary Responsibilities
  • Own and mature the firm-wide client and vendor due-diligence program, ensuring consistency, accuracy, and alignment with the firm's security posture and regulatory obligations.
  • Serve as the firm's subject-matter expert on information-security controls, certifications, and risk posture during client audits, RFPs, and reviews or client engagement terms.
  • Lead complex vendor-risk assessments for high-impact technology and service providers, including review of SOC 2 reports, ISO 27001 certifications, penetration-test results, cloud-security controls, data-protection, privacy, and retention practices.
  • Develop and maintain the firm's vendor-risk management framework, including risk-scoring methodologies, onboarding workflows, and continuous-monitoring processes.
  • Partner with Procurement, IT, and Office of General Counsel to evaluate vendor contracts, negotiate security requirements, and recommend risk-mitigation strategies.
  • Prepare the firm for client audits and regulatory reviews, coordinating evidence collection, documentation, and SME participation across multiple departments.
  • Represent the firm in client-facing security discussions, including responding to escalated inquiries from corporate counsel, privacy officers, and client security teams.
  • Monitor emerging risks and regulatory developments relevant to the legal industry (e.g., SEC cybersecurity rules, state privacy laws, international data-transfer requirements).
  • Mentor junior analysts and contribute to the professional development of the broader Risk and Compliance team.
  • Drive continuous improvement, identifying opportunities to streamline due-diligence workflows, enhance tracking and remediation of client-identified risks, and strengthen the firm's security posture.

Additional Responsibilities
  • Provide management with periodic reports & briefings on evolving topics within their area of responsibility.
  • Other related projects and duties as assigned by the Director of Information Security.

WHAT YOU'LL BRING

Required
  • 6+ years of experience in information security, vendor risk management, compliance, or legal-industry operations, ideally within an Am Law 200 firm or similarly regulated environment.
  • Deep understanding of security frameworks and standards (SOC 2, ISO 27001, NIST CSF, HIPAA, GLBA, state privacy laws).
  • Experience conducting or leading vendor-risk assessments for enterprise-level technology providers.
  • Strong communication skills, including the ability to brief partners, respond to client security teams, and translate technical concepts for non-technical audiences.
  • Demonstrated ability to work independently, manage sensitive information, and lead cross-functional initiatives in a high-pressure environment.
  • Professional certifications such as CTPRA, ISO 27001 Lead Implementer or Lead Auditor and CISSP, CISM, CRISC, or CISA required.
  • Experience with legal-industry technologies (DMS, e-discovery platforms, cloud-based practice-management tools) is a plus.

HOW YOU'LL WORK

Extent of Contact

This position requires contact with individuals within the firms as follows:
  • Daily contact with staff from the Firm's Information Technology, Client Development and Office of the General Counsel teams.
  • Moderate contact with Firm's attorneys and client representatives.
  • Occasional contact with Firm Management.

This position requires contact with individuals outside the firm as follows:
  • Moderate contact with Firm vendors or potential vendors.
  • Moderate contact with Firm clients

Physical Requirements
  • Must be able to routinely lift and carry event materials and other items up to 10 pounds.
  • Must be able to work at a computer for extensive periods of time.
  • Position requires extensive telephone use.
  • Must be able to lift, squat, kneel and bend.
  • Position requires the ability to visit face-to-face and on the phone with firm lawyers.

Working Conditions and Environment
  • Position is full-time and requires a five-day work week and standard hours as outlined in the Firm policy manual. Additional hours, including weekend and evening hours may be required to perform the essential functions of the job.
  • Must be able to perform essential duties of the position with time constraints and frequent interruptions.
  • Ability to work well in high pressure environments.
  • 24x7 communication access is required.
  • This position is fully remote. You will be required to come to the office periodically for team meetings or when there is a business or client need.
  • There is potential for travel when needed for team meetings, onsite assessments etc. when there is a business or client need.
  • When working remotely, you must have secure and reliable internet service and a safe, private workspace from which to work.

About Baker Botts LLP

Baker Botts is a full-service, leading global law firm, recognized for our understanding of the industries we serve. Our firm has a long, distinguished tradition of service to our clients, tracing our history back to the 1840s. During the earliest days of Houston, Baker Botts represented the burgeoning industries of cotton merchants, brokers and railroads. Today, we continue to serve clients in the energy, technology, life sciences, construction, infrastructure, finance and media industries, among others, from offices around the world. Our lawyers have helped clients navigate the challenges of complex transactions, investigations, litigation and regulatory matters for more than 175 years. We have a deep bench of lawyers in the United States, Europe, the Middle East and Asia, and our global footprint allows us to handle the most complex matters for clients wherever they arise. Our lawyers are recognized for their ability to solve problems creatively and pragmatically, and for their commitment to client service. We are proud of our heritage and our reputation for excellence, and we are committed to continuing to provide our clients with the highest quality legal services.
Learn more about Baker Botts LLP
Size
1,500 employees
Industry
Legal & Accounting
Founded
1840
* Ladders Estimates

Similar Jobs

Ad banner background

Get Ready For Your
Next Interview

More Jobs at Baker Botts LLP

More Legal & Accounting Jobs

Find similar Client & Vendor Risk Manager jobs:

NationwideDallas, TX