GRC (Governance, Risk, and Compliance) Consultant
Posted
Summary
Remote contract role for a GRC Consultant who designs corporate security governance frameworks, leads enterprise risk assessments, prepares audits for frameworks like ISO 27001, SOC 2, NIST, PCI-DSS, GDPR, and HIPAA, and manages vendor risk and internal control audits. Requires 5-9 years of experience (4+ in GRC) and a CISA, CRISC, or CISM certification.
This is a remote position.
GRC (Governance, Risk, and Compliance) Consultant
Job Details
- Employment Type: Contract
- Work Mode: Remote
- Location: Offshore
- Total Experience Required: 5 to 9 years
- Relevant Experience Required: 4+ years of dedicated experience delivering information security governance, risk assessments, and compliance audits
- Mandatory Certification: Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), or Certified Information Security Manager (CISM)
Job Summary
We are seeking an experienced GRC Consultant to design, evaluate, and monitor our corporate cybersecurity governance frameworks and risk management strategies. The ideal candidate will translate complex regulatory frameworks into actionable policy layers, lead enterprise risk assessments, manage third-party vendor audits, and ensure continuous compliance across complex digital landscapes.
Key Responsibilities
- Design and maintain corporate security governance frameworks, writing information security policies, procedural standards, and control guidelines aligned with global benchmarks.
- Lead comprehensive enterprise risk assessments, identifying infrastructure vulnerabilities, evaluating operational impacts, mapping threat probabilities, and tracking remediation registers.
- Orchestrate regulatory compliance audit preparedness campaigns, validating configurations against mandated frameworks including ISO 27001, SOC 2 Type II, NIST, PCI-DSS, GDPR, or HIPAA.
- Govern third-party vendor risk assessment pipelines, reviewing external service provider security posture configurations, evaluating SOC reports, and defining contract security data guidelines.
- Manage internal control validation audits, testing control effectiveness across identity management systems, change configuration lines, asset trackers, and incident logging setups.
- Facilitate security awareness programs and compliance training drives, building materials to educate workforce divisions on corporate data protection responsibilities and social engineering risks.
- Coordinate directly with internal executive stakeholders and external auditors, assembling compliance evidence evidence packages, documenting control gaps, and presenting risk posture matrices.
Requirements
- 5 to 9 years of core information technology audit or security compliance experience, with 4+ dedicated years actively managing governance, risk, and regulatory tracks.
- Strong technical mastery of specialized GRC software ecosystems (e.g., OneTrust, ServiceNow GRC, MetricStream), risk modeling frameworks, and document evidence gathering.
- Deep structural understanding of information security perimeters, data privacy laws, identity governance baselines, and audit remediation lifecycles.
- Mandatory certification: CISA, CRISC, or CISM.
Preferred Qualifications
- Certified Information Systems Security Professional (CISSP) designation.
- Prior consulting background driving complex multi-framework compliance alignments for fast-scaling enterprise cloud infrastructures or global financial institutions.