Cybersecurity GRC Consultant – Remote

About the role

We are seeking a senior Cybersecurity GRC Consultant to join a fast‑growing U.S. cybersecurity and compliance consulting startup. The role is 100% remote, full‑time, and focuses on leading audit readiness, compliance program development, and risk management for technology‑driven clients.

Key responsibilities

• Lead compliance readiness engagements for frameworks such as SOC 2 Type I/II, ISO 27001, HIPAA, U.S. state privacy laws, and GDPR.
• Own and operate GRC platforms (e.g., Vanta, Drata) to maintain continuous evidence collection and monitoring.
• Conduct formal risk assessments using NIST 800‑30 and translate technical findings into business‑level risks.
• Design and implement end‑to‑end GRC programs, including policies, control frameworks, risk‑management processes, and evidence collection.
• Perform internal audits, evaluate control design and operational effectiveness, and prepare audit‑ready findings.
• Manage vendor security questionnaires, coordinate with subject‑matter experts, and maintain reusable knowledge bases.
• Build strong relationships with client leadership, lead recurring status meetings, and manage expectations.
• Produce high‑quality deliverables such as policies, procedures, risk registers, control matrices, evidence packages, and assessment reports.

Required profile

• 5–7+ years of hands‑on experience in GRC, compliance, or information‑security audits.
• Consulting or professional‑services background managing multiple client engagements.
• Deep expertise with SOC 2 Type I & II and ISO 27001/ISO 27002.
• Experience with additional frameworks such as GDPR, CCPA/CPRA, or HIPAA.
• Proven ability to build compliance programs from the ground up and map controls across frameworks.
• Solid technical understanding of cloud security.

Required skills

• SOC 2 Type I & II
• ISO 27001 / ISO 27002
• GDPR
• CCPA/CPRA
• HIPAA
• Vanta
• Drata
• NIST 800‑30 risk assessment
• Cloud security