Senior GRC Consultant

About the role

We are looking for a Senior GRC Consultant to join a fast‑growing U.S. cybersecurity and compliance consulting startup. The role is fully remote and focuses on leading audit readiness, building compliance programs and managing risk across multiple client engagements.

Key responsibilities

• Lead compliance readiness engagements for frameworks such as SOC 2 Type I/II, ISO 27001, HIPAA, U.S. state privacy laws and GDPR.
• Own and operate GRC platforms (e.g., Vanta, Drata) to maintain continuous evidence collection and monitoring.
• Conduct formal risk assessments using NIST 800‑30 and translate technical findings into business‑level risk reports.
• Design and implement end‑to‑end GRC programs, including policies, control frameworks, risk registers and evidence packages.
• Perform internal audits, evaluate control design and effectiveness, and prepare audit‑ready findings.
• Manage vendor security questionnaires and build reusable knowledge bases.
• Build strong relationships with client leadership, lead recurring status meetings and set expectations.
• Produce high‑quality deliverables such as policies, procedures, control matrices and assessment reports.

Required profile

• 5–7+ years of hands‑on experience in GRC, compliance or information‑security audits.
• Previous consulting or professional‑services experience managing multiple client engagements.
• Deep knowledge of SOC 2, ISO 27001/27002 and at least one additional framework (GDPR, CCPA/CPRA, HIPAA).
• Proven ability to build compliance programs from the ground up and map controls across frameworks.

Required skills

• SOC 2 Type I and Type II
• ISO 27001 and ISO 27002
• GDPR
• CCPA/CPRA
• HIPAA
• NIST 800‑30 risk assessment methodology
• Vanta
• Drata