Bachelor's degree in Business Information Systems, Cybersecurity, Risk Management, Compliance, or a related field.
Experience in technology risk, governance, compliance, information security, audit, or third-party risk management.
Strong experience with vendor risk assessments for SaaS, cloud providers, and AI-enabled products.
Familiarity with security frameworks like ISO 27001, SOC standards, and NIST.
Experience interfacing with auditors and responding to compliance questionnaires.
Ability to assess technology vendors and communicate findings effectively.
Strong communication skills for collaboration across various teams.
Experience with governance, risk, and compliance platforms like Drata preferred.
Knowledge of AI-related risks and emerging compliance considerations preferred.
Responsibilities
Own and manage the third-party risk management program, including vendor assessments and onboarding reviews.
Partner with cross-functional teams to identify and mitigate technology and vendor-related risks.
Review compliance reports and documentation, including SOC and ISO certifications.
Interface with auditors and vendors to gather documentation and support audit readiness.
Support responses to technology-related third-party questionnaires.
Maintain organized records of assessments and compliance evidence.
Prepare risk summaries and reports for leadership review.
Support ISO 27001 certification and SOC 2 compliance efforts.
Collaborate to create and implement AI-related governance practices.
Enhance the business continuity plan with relevant stakeholders.
Benefits
Collaborative work environment with cross-functional teams.
Opportunity to work with cutting-edge technology and AI-related standards.
Professional development opportunities in risk management and compliance.
Support for maintaining industry certifications like ISO 27001 and SOC 2.
Engagement with diverse stakeholders, enhancing communication and collaboration skills.
Full Job Description
Job Summary
Own and manage the third-party risk management program, including risk-based vendor assessments, onboarding reviews, and periodic evaluations throughout the vendor lifecycle.
Partner with Information Security, Legal, Compliance, IT, and business stakeholders to identify, assess, document, and mitigate technology, cybersecurity, privacy, AI, and vendor-related risks.
Review SOC 1 and SOC 2 reports, ISO 27001 certifications, penetration testing reports, business continuity plans, disaster recovery documentation, privacy materials, and related compliance evidence.
Interface with third-party auditors, vendors, and internal stakeholders to gather documentation, respond to assessment requests, and support audit readiness.
Support responses to technology-related third-party questionnaires, ensuring information is accurate, complete, consistent, and professionally documented.
Maintain organized assessment records, risk documentation, compliance evidence, and supporting materials in accordance with internal policies and procedures.
Prepare risk summaries, dashboards, reports, and governance materials for leadership and committee review.
Maintain and support Pinnacle Group's ISO 27001 certification and SOC 2 compliance in partnership with IT and other key stakeholders.
Collaborate with cross-functional teams to create, maintain, and implement AI-related standards, procedures, and risk governance practices.
Enhance and maintain Pinnacle Group's business continuity plan in collaboration with appropriate business and technology stakeholders.
Qualifications
Bachelor's degree in Business Information Systems, Cybersecurity, Risk Management, Compliance, or a related field.
Experience in technology risk, governance, compliance, information security, audit, third-party risk management, or a related discipline.
Strong experience performing vendor risk assessments for SaaS platforms, cloud providers, managed service providers, software vendors, and AI-enabled products.
Working knowledge of security and compliance frameworks such as ISO 27001, SOC standards, NIST, CIS Controls, and related governance practices.
Experience interfacing with third-party auditors and responding to security, risk, compliance, or vendor assessment questionnaires.
Ability to assess technology vendors, identify risk concerns, document findings, and communicate recommendations clearly to technical and non-technical stakeholders.
Strong written and verbal communication skills with the ability to collaborate effectively across auditors, vendors, IT, Legal, Compliance, and business teams.
Experience using Drata or similar governance, risk, and compliance platforms preferred.
Working knowledge of AI-related risks, controls, governance standards, and emerging compliance considerations preferred.
About Pinnacle living
Pinnacle Financial Partners is an American bank headquartered in Nashville, Tennessee operating in Middle Tennessee, East Tennessee, and, since June 2017, North Carolina, South Carolina, and Virginia.
