Conduct security, privacy, and business due diligence: issue and review security questionnaires (e.g., SIG, CAIQ, custom assessments), evaluate architecture diagrams and data flows, run follow-up sessions with vendor security teams, and coordinate business checks such as corporate registration, reputational review, and insurance coverage with cross-functional partners. The ideal candidate brings a cybersecurity and GRC perspective — fluent in how cloud services, identity and access management, encryption, data flows, and AI/LLM systems actually work in production — and can translate assessment findings into clear, risk-based decisions on residual risk and compensating controls rather than simply documenting issues.