GRC CONSULTANT (REMOTE)

iTRTech Group; Brasil; Remote; BRL 141,000 - 160,000; Full time

Job summary

iTRTech Group is seeking a mid-level GRC Consultant to join a global cybersecurity team, working remotely from Brazil with collaboration across Portugal and Brazil. You will drive governance, risk, and compliance initiatives, focusing on third-party risk, risk assessments, audits, and awareness programs.

The role requires 3-5 years of Information Security GRC experience, fluency in Portuguese and English, and hands-on familiarity with frameworks like NIST, ISO 27001, SOC 2, CIS Controls.

Qualifications

• 3-5 years of professional experience in Information Security Governance, Risk and Compliance (GRC).
• Experience with Third-Party Cyber Risk Management.
• Experience conducting Cyber Risk Assessments.
• Experience supporting Security Audits and Compliance activities.
• Experience developing or supporting Security Awareness and Training initiatives.
• Knowledge of security frameworks including NIST, ISO 27001, SOC 2, CIS Controls.
• Fluent in Portuguese and English (mandatory).
• Experience with GRC platforms such as ServiceNow IRM or OneTrust is a plus.

Responsibilities

• Support the third-party cyber risk management process.
• Assess vendors against cybersecurity requirements by reviewing security questionnaires and supporting evidence.
• Challenge incomplete or insufficient responses from suppliers.
• Communicate assessment results to both technical and business stakeholders.
• Monitor remediation plans and follow up on corrective actions.
• Conduct cybersecurity risk assessments and monitor cyber risks using industry frameworks such as NIST, ISO 27001, SOC 2, CIS Controls.

Skills

GRC

Third-Party Risk

Cyber Risk Assessments

Security Audits

Security Awareness Training

ISO 27001

NIST

SOC 2

CIS Controls

Microsoft Office

Portuguese & English Fluency

Tools

ServiceNow IRM

OneTrust

Lucy Security Awareness Platform

Job description

GRC CONSULTANT (REMOTE BRAZIL)

Portuguese company hires for remote position

Location: Remote Brazil

Language Requirements: Fluent Portuguese and English

Seniority: 3-5 years of experience

Sector: Cybersecurity / Information Security

Rate €2200 - 2500 RV

Help Strengthen Cybersecurity Governance

We are looking for a Security Governance, Risk and Compliance (GRC) Consultant to join an international cybersecurity team. This role is ideal for professionals with experience in Governance, Risk and Compliance who enjoy working in a dynamic environment, collaborating with teams across Portugal and Brazil, and contributing to the continuous improvement of cybersecurity processes.

Third-Party Cyber Risk Management

• Support the third-party cyber risk management process.
• Assess vendors against cybersecurity requirements by reviewing security questionnaires and supporting evidence.
• Challenge incomplete or insufficient responses from suppliers.
• Communicate assessment results to both technical and business stakeholders.
• Monitor remediation plans and follow up on corrective actions.

Cyber Risk Management

• Conduct cybersecurity risk assessments.
• Identify, assess, document, and monitor cyber risks.
• Support the organization's risk management process using ServiceNow IRM.
• Apply industry security frameworks such as NIST and CIS Controls.

Security Awareness

• Coordinate phishing simulation campaigns.
• Deliver cybersecurity awareness training sessions.
• Create internal cybersecurity communications.
• Maintain and continuously improve annual security awareness content.

Audit & Compliance

• Support internal and external security audits.
• Coordinate evidence collection with internal stakeholders.
• Validate audit evidence and documentation.
• Track remediation activities resulting from audit findings.

Required Skills & Experience

• 3-5 years of professional experience in Information Security Governance, Risk and Compliance (GRC).
• Experience with Third-Party Cyber Risk Management.
• Experience conducting Cyber Risk Assessments.
• Experience supporting Security Audits and Compliance activities.
• Experience developing or supporting Security Awareness and Training initiatives.
• Knowledge of security frameworks including:NISTISO 27001SOC 2CIS Controls
• NIST
• ISO 27001
• SOC 2
• CIS Controls
• Strong Microsoft Office skills.
• Fluent Portuguese and English (mandatory).
• Excellent organizational skills and ability to manage multiple priorities.
• Proactive mindset with strong attention to detail.

Nice to Have

• Experience with GRC platforms such as:ServiceNow IRMOneTrust
• ServiceNow IRM
• OneTrust
• Experience with Lucy Security Awareness platform.
• Security certifications such as:ISO 27001 Lead AuditorCompTIA Security+AWS CertificationsMicrosoft Security Certifications
• ISO 27001 Lead Auditor
• CompTIA Security+
• AWS Certifications
• Microsoft Security Certifications

Soft Skills

• Excellent communication and stakeholder management skills.
• Strong analytical and problem-solving abilities.
• Ability to work independently and collaboratively.
• Highly organized and detail-oriented.
• Comfortable working in multicultural and international environments.
• Ability to prioritize multiple activities while meeting deadlines.
• Continuous learning mindset and passion for cybersecurity.

Candidate Profile Summary

We are looking for a mid-level GRC Consultant with 3-5 years of experience in Information Security Governance, Risk and Compliance. The ideal candidate has hands-on experience in third-party cyber risk management, security audits, cyber risk assessments, and security awareness initiatives. Strong knowledge of security frameworks such as NIST, ISO 27001, SOC 2, and CIS Controls is essential. The successful candidate is analytical, proactive, detail-oriented, and able to manage multiple priorities while collaborating effectively with technical and business teams. Fluency in Portuguese and English is mandatory, as the role involves working with teams in Portugal and Brazil. Experience with ServiceNow IRM, OneTrust, or other GRC platforms, as well as security certifications, will be considered a strong advantage.

Before You Apply – Ask Yourself These 5 Questions

• Do I have at least 3 years of hands-on experience in Information Security Governance, Risk and Compliance (GRC)?
• Have I participated in third-party cyber risk assessments, security audits, or cybersecurity risk management activities using frameworks such as NIST, ISO 27001, SOC 2, or CIS Controls?
• Am I comfortable communicating with both technical and business stakeholders in English and Portuguese?
• Have I worked with GRC platforms (such as ServiceNow IRM or OneTrust), or do I have practical experience with similar governance and compliance tools?
• Can I confidently demonstrate examples of supporting security awareness initiatives, audit activities, vendor assessments, or remediation tracking during an interview?

Keywords – Must Be Clearly Listed in the CV

GRC, Information Security, Cybersecurity, Governance, Risk Management, Compliance, Third-Party Risk Management, Vendor Risk, Cyber Risk Assessment, Security Audit, Security Awareness, NIST, ISO 27001, SOC 2, CIS Controls, ServiceNow IRM, OneTrust, Security Frameworks, Risk Assessment, Microsoft Office, English, Portuguese

#CF