Cybersecurity GRC Specialist II

About the role

As a Security GRC Specialist II, you’ll be a key member of the Governance, Risk, and Compliance (GRC) team, leading and executing core GRC programs while serving as a trusted Information Security subject matter expert. This role blends strategic oversight with hands-on execution—partnering with technical teams, business stakeholders, clients, and vendors to ensure security controls, policies, and risk practices are effective, compliant, and clearly communicated.

Responsibilities

• Lead responses to client security assessments, questionnaires, and audits, documenting evidence and performing risk assessments as needed.
• Create, maintain, and evolve security policies, standards, guidelines, and supporting documentation through strong technical writing.
• Manage and support processes that ensure Information Technology (IT) systems meet cybersecurity, risk, and compliance requirements.
• Serve as an Information Security subject matter expert, advising technical and non-technical stakeholders across the organization.
• Manage the third-party Security Vendor Risk Management program, including assessments, remediation tracking, and lifecycle oversight.
• Oversee the security exception request process and provide guidance on appropriate risk treatment decisions.
• Manage the full lifecycle of the Security Awareness program, including roadmap development, training evaluation, and effectiveness measurement.
• Support and optimize Governance, Risk, and Compliance (GRC) technology platforms and associated workflows.
• Conduct evaluations of IT programs and components to confirm alignment with published security standards and frameworks.

Requirements

• Bachelor's degree or equivalent with five (5) years of work experience in IT Security is required.
• Four (4) or more years of Information Security experience, with hands-on technical experience strongly preferred.
• Strong working knowledge of security frameworks and standards such as ISO 27001, National Institute of Standards and Technology (NIST), System and Organization Controls (SOC), and Standardized Information Gathering (SIG) is required.
• Experience in Artificial Intelligence (AI) governance, security, and risk management is required.
• Proven ability to produce clear, well-structured security documentation and communicate complex technical topics to varied audiences.
• Experience leading risk assessments, vendor security reviews, and client-facing security discussions with professionalism and tact.
• Familiarity with GRC platforms, role-based access controls, and a broad range of security technologies and tools.
• Strong problem-solving, project management, and time management skills with the ability to work independently or collaboratively.
• Working knowledge of areas such as authentication, encryption, firewalls, SIEM, intrusion detection/prevention, vulnerability management, mobile security, and privileged access management.
• Client-focused mindset with strong interpersonal skills, attention to detail, and a commitment to maintaining accurate records and documentation.

Qualifications

• Certified Information Systems Security Professional (CISSP), Certified Information Security Auditor (CISA), Certified Information Security Manager (CISM), Advanced in AI Audit (AAIA), Advanced in AI Risk (AAIR), Advanced in AI Security Management (AAISM) or other relevant training and certifications are preferred.

Pay

The base salary range for this position in Chicago is $116,000 - $144,000. This range may differ based on your geographic location and cost of living considerations.

Benefits

At Kirkland & Ellis, we offer an exceptional range of flexible benefits including comprehensive healthcare, paid time off, and retirement. We also provide personal support and tailored learning and development opportunities designed to help you realize your full potential both in life and at work.