GRC (Governance, Risk, and Compliance) Consultant

This is a remote position.

• Employment Type: Contract
  
• Work Mode: Remote
  
• Location: Offshore
  
• Total Experience Required: 5 to 9 years
  
• Relevant Experience Required: 4+ years of dedicated experience delivering information security governance, risk assessments, and compliance audits
  
• Mandatory Certification: Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), or Certified Information Security Manager (CISM)
  

• Design and maintain corporate security governance frameworks, writing information security policies, procedural standards, and control guidelines aligned with global benchmarks.
  
• Lead comprehensive enterprise risk assessments, identifying infrastructure vulnerabilities, evaluating operational impacts, mapping threat probabilities, and tracking remediation registers.
  
• Orchestrate regulatory compliance audit preparedness campaigns, validating configurations against mandated frameworks including ISO 27001, SOC 2 Type II, NIST, PCI-DSS, GDPR, or HIPAA.
  
• Govern third-party vendor risk assessment pipelines, reviewing external service provider security posture configurations, evaluating SOC reports, and defining contract security data guidelines.
  
• Manage internal control validation audits, testing control effectiveness across identity management systems, change configuration lines, asset trackers, and incident logging setups.
  
• Facilitate security awareness programs and compliance training drives, building materials to educate workforce divisions on corporate data protection responsibilities and social engineering risks.
  
• Coordinate directly with internal executive stakeholders and external auditors, assembling compliance evidence evidence packages, documenting control gaps, and presenting risk posture matrices.
  

Requirements

• 5 to 9 years of core information technology audit or security compliance experience, with 4+ dedicated years actively managing governance, risk, and regulatory tracks.
  
• Strong technical mastery of specialized GRC software ecosystems (e.g., OneTrust, ServiceNow GRC, MetricStream), risk modeling frameworks, and document evidence gathering.
  
• Deep structural understanding of information security perimeters, data privacy laws, identity governance baselines, and audit remediation lifecycles.
  
• Mandatory certification: CISA, CRISC, or CISM.
  

• Certified Information Systems Security Professional (CISSP) designation.
  
• Prior consulting background driving complex multi-framework compliance alignments for fast-scaling enterprise cloud infrastructures or global financial institutions.