Senior GRC Consultant

About the role

We are seeking a Senior GRC Consultant to join a fast‑growing U.S. cybersecurity and compliance consulting startup. This remote, full‑time contractor role will have you leading audit readiness, compliance program development, and risk management for multiple technology clients.

Key responsibilities

• Lead compliance readiness engagements for frameworks such as SOC 2 Type I/II, ISO 27001, HIPAA, GDPR and U.S. state privacy laws.
• Own and operate GRC platforms (e.g., Vanta, Drata) to maintain continuous evidence collection and monitoring.
• Conduct formal risk assessments using NIST 800‑30 and translate technical findings into business risks.
• Design and implement end‑to‑end GRC programs, including policies, control frameworks, and evidence packages.
• Perform internal audits, evaluate control design and effectiveness, and prepare audit‑ready findings.
• Manage vendor security questionnaires and build reusable knowledge bases.
• Engage with client leadership, provide status updates, and deliver high‑quality deliverables such as risk registers and control matrices.

Required profile

• 5–7+ years of hands‑on experience in GRC, compliance, or information‑security audits.
• Prior consulting or professional‑services experience managing multiple client engagements.
• Proven ability to build compliance programs from the ground up and map controls across frameworks.

Required skills

• Vanta
• Drata
• SOC 2 (Type I & II)
• ISO 27001 / ISO 27002
• HIPAA
• GDPR
• CCPA / CPRA
• NIST 800‑30 risk assessment methodology