Cyber Security GRC Consultant

Experience Required

8–10 Years

Role Description

Lead and execute end-to-end third-party/vendor risk assessments across technology, supply chain, SaaS, and hybrid environments. Perform technical security reviews, SOC 2 analysis, risk assessment, remediation tracking, and GRC program activities while ensuring alignment with enterprise security policies and industry frameworks.

Roles & Responsibilities

• Lead third-party/vendor risk assessments, identify control gaps, and recommend risk mitigation strategies.

• Perform technical reviews of solution/application architectures, security controls, and cloud solutions from a security engineering perspective.

• Conduct SOC 2 analysis and evaluate control design and operating effectiveness.

• Ensure alignment with enterprise security policies, data protection standards, SOC 2, and ISO 27001.

• Leverage GRC and risk intelligence platforms such as RSA Archer, Onspring, BitSight, UpGuard, SecurityScorecard, and ServiceNow or similar tools.

• Coordinate with Legal, Procurement, IT, Privacy, Audit, and Security Operations teams for assessment completion and remediation tracking.

• Develop and report risk metrics and program insights to leadership to support continuous improvement of the TPRM program.

• Contribute to information security policies, standards, and exception processes based on risk findings and industry best practices.

• Communicate complex technical and risk concepts clearly to technical and non-technical stakeholders and build trusted relationships across business units.

Must-Have Skills

• GRC – Vendor Risk Assessment / Third-Party Risk Assessment

• Cyber Security GRC

• Data Security

• Third-Party Risk Management (TPRM)

• SOC 2 and ISO 27001

• Security controls and cloud security

• GRC and risk intelligence platforms