Senior GRC Consultant

About the role

We are seeking a Senior GRC Consultant to lead audit readiness, compliance program development, and risk management for our fast‑growing cybersecurity consulting startup. This remote, full‑time contractor role offers the chance to work directly with executive stakeholders and external auditors across multiple frameworks.

Key responsibilities

• Lead compliance readiness engagements for SOC 2 Type I/II, ISO 27001, HIPAA, U.S. state privacy laws, and GDPR.
• Own and operate GRC platforms such as Vanta or Drata, ensuring continuous evidence collection.
• Conduct formal risk assessments using NIST 800‑30 and translate findings into business risks.
• Design and implement end‑to‑end GRC programs, including policies, control frameworks, and risk registers.
• Perform internal audits, evaluate control design and effectiveness, and prepare audit‑ready documentation.
• Manage vendor security questionnaires and maintain reusable knowledge bases.
• Build strong relationships with client leadership, provide status updates, and deliver high‑quality deliverables such as policies, procedures, and assessment reports.

Required profile

• 5–7+ years of hands‑on experience in GRC, compliance, or information‑security audits.
• Previous consulting or professional‑services experience managing multiple client engagements.
• Proven ability to build compliance programs from the ground up and map controls across frameworks.

Required skills

• SOC 2 Type I & II
• ISO 27001 / ISO 27002
• GDPR, CCPA/CPRA, HIPAA
• NIST 800‑30 risk assessment methodology
• GRC platforms (e.g., Vanta, Drata)
• Internal audit and control evaluation
• Vendor security questionnaire management