Senior GRC Consultant

About the role

We are seeking a Senior Governance, Risk, and Compliance (GRC) Consultant to lead audit‑readiness and compliance program development for a fast‑growing U.S. cybersecurity consulting startup. This fully remote, long‑term contractor role offers direct client exposure and the chance to shape security programs for innovative technology companies.

Key responsibilities

• Lead compliance readiness engagements for SOC 2 Type I/II, ISO 27001/27002, HIPAA, U.S. state privacy laws, and GDPR/CCPA.
• Own and operate GRC platforms such as Vanta or Drata, ensuring continuous evidence collection.
• Conduct formal risk assessments using NIST 800‑30 and translate findings into business‑level risks.
• Design and implement end‑to‑end GRC programs, including policies, control frameworks, and risk registers.
• Perform internal audits, evaluate control design and effectiveness, and prepare audit‑ready deliverables.
• Manage vendor security questionnaires and maintain reusable knowledge bases.
• Build strong relationships with client leadership, lead status meetings, and set expectations throughout engagements.

Required profile

• 5–7+ years of hands‑on GRC, compliance, or information‑security audit experience.
• Prior consulting or professional‑services background managing multiple client engagements.
• Proven expertise in SOC 2, ISO 27001/27002, and at least one additional framework (GDPR, CCPA/CPRA, HIPAA).
• Experience building compliance programs from the ground up and mapping controls across frameworks.

Required skills

• SOC 2 Type I & II
• ISO 27001 / ISO 27002
• GDPR, CCPA/CPRA, HIPAA
• NIST 800‑30 risk assessment methodology
• Vanta, Drata (or similar GRC platforms)
• Audit readiness and evidence collection
• Control mapping across multiple compliance frameworks