Nelnet is a diversified and innovative company committed to enriching lives through the power of service as a student loan servicer, professional services company, consumer loan originator and servicer, payments processor, renewable energy solutions, and K-12 and higher education expert. For over 40 years, Nelnet has been serving its customers, associates, and communities.
The perks of working at Nelnet go beyond our benefits package. When you join the Nelnet team, you're part of a community invested in the success of each individual. That support comes through in our work, as we are united by our mission of creating opportunities for people where they live, learn, and work.
The IAM GRC Lead is the Identity & Access Management team’s primary point of contact and lead for audits, regulatory reviews, and third-party information requests. This role leads the team’s audit program from planning through close for annual SOC 1 and SOC 2 audits, U.S. Department of Education requirements and other third-party clients for identity systems, and due-diligence requests from banks, lenders, and other financial institution partners.
Beyond answering requests, this person owns the process: building a centralized library of approved responses and evidence, standardizing how the team answers recurring questions, and reducing the time and effort engineers spend on audit work. The goal is fast, accurate, consistent answers every time. This role partners with compliance, internal audit, external audit, cyber, and others so every identity related request has one accountable owner.
This position offers a hybrid work option. Nelnet values flexibility and understands the importance of work-life integration. Our hybrid work environment allows associates within 30 miles of an office to work remotely for part of the week, while also fostering collaboration and team connection through in-office presence.
Please note that we are unable to provide visa sponsorship for this position. To be considered, candidates must already be authorized to work in the United States without the need for current or future sponsorship as security clearance is required .
Compensation range for this role is $80,000- $110,000 annually, depending on experience .
Audit & Request Response
Serve as the IAM team’s primary liaison and audit lead for internal audit, external auditors, compliance, and third-party risk teams during SOC 1 and SOC 2 examinations.
Lead the full IAM audit lifecycle, including planning, kickoff, fieldwork, findings, and close.
Negotiates scope, sample sizes and timelines with auditors. Can challenge findings or exceptions that are inaccurate or out of scope.
Run pre-audit readiness reviews and periodic control self-testing so gaps are found and fixed before auditors find them.
Receive, triage, and track all identity-related requests, including audit PBC (Provided by Client) lists, control walkthroughs, sample requests, and follow-up questions.
Respond to Department of Education requirements and reviews related to identity systems, authentication, and access controls, in coordination with Compliance.
Complete security questionnaires and due-diligence requests from banks and financial institutions (e.g., SIG, CAIQ, and custom questionnaires) covering identity, authentication, provisioning, and access review practices.
Gather evidence from IAM systems and engineers, verify it is complete and accurate, and deliver it on time.
Schedule and prepare subject matter experts for auditor walkthroughs and interviews.
Information Management
Build and maintain a centralized, version-controlled repository of IAM policies, procedures, control narratives, system diagrams, and evidence artifacts.
Map IAM controls to relevant frameworks and requirements (SOC 1/SOC 2 Trust Services Criteria, Department of Education requirements, NIST, FFIEC, GLBA, and customer contractual obligations).
Maintain an audit calendar tracking recurring deadlines, evidence collection windows, and…