GRC Consultant

LTM; München; On-site; EUR 140,000 - 190,000; Full time

Job summary

LTM in Germany seeks a German-speaking Principal Cloud Security and GRC Lead with 15+ years of experience in enterprise Governance, Risk and Compliance, Microsoft 365/Azure security, cloud solution architecture, audit and regulatory compliance.

The role will lead customer-facing GRC and cloud-security services, establish and operate a resilient GRC framework, support M365 governance and compliance maturity assessment, and translate complex risk topics into clear business outcomes.

Qualifications

• 15+ years in enterprise Governance, Risk and Compliance.
• Experience with M365 governance and compliance maturity assessment.
• Ability to translate complex risk topics into business outcomes.

Responsibilities

• Lead the customer-facing Cloud Security and GRC service, coordinate a global delivery team, and act as a trusted advisor to stakeholders.
• Establish, maintain and improve the enterprise GRC operating model across policy and compliance management, risk management, audit management, control assurance, evidence management and regulatory reporting.
• Lead implementation and operation of Microsoft Compliance Manager (MCM), Alyne GRC and/or comparable platforms, including configuration, upgrades, migration, workflow design and reporting.
• Drive the M365 Governance, Risk and Compliance maturity assessment: establish the current-state baseline, assess maturity, identify gaps, define target state and remediation roadmap.
• Use Microsoft Purview, Microsoft Defender for Cloud and relevant Microsoft security/compliance capabilities to support security posture reviews and recommendations.
• Architect and govern secure Microsoft Azure and M365 solutions using native security controls and cloud security best practices.
• Perform and coordinate security and compliance risk assessments, control reviews and audit support across cloud and M365 environments; maintain registers.
• Support internal and external audits, ensure timely closure of findings and provide clear management reporting on risks and actions.
• Align controls with ISO 27001, NIST CSF, CSA CCM, COBIT 2019, GDPR, DORA, SOX ITGC.
• Facilitate solution and control workshops, document designs, define governance processes and RACI, maintain policies and control narratives.
• Provide strategic guidance for cloud security incidents, risk treatment and exception management, and coordinate with stakeholders.

Skills

Cloud Security

GRC

Azure Security

Regulatory Compliance

Tools

Microsoft Purview

Microsoft Defender

Alyne GRC

Job description

Seeking a German-speaking Principal Cloud Security and GRC Lead with 15+ years of experience in enterprise Governance, Risk and Compliance, Microsoft 365/Azure security, cloud solution architecture, audit and regulatory compliance. The role will lead customer-facing GRC and cloud-security services, establish and operate a resilient GRC framework, support M365 governance and compliance maturity assessment, and translate complex risk and compliance topics into clear business outcomes

Key Responsibilities

• Lead the customer-facing Cloud Security and GRC service, coordinate a global delivery team, and act as a trusted advisor to stakeholders.
• Establish, maintain and continuously improve the enterprise GRC operating model across policy and compliance management, risk management, audit management, control assurance, evidence management and regulatory reporting.
• Lead implementation and operation of Microsoft Compliance Manager (MCM), Alyne GRC and/or comparable integrated risk management platforms, including configuration, upgrades, migration, workflow design and reporting.
• Drive the M365 Governance, Risk and Compliance maturity assessment: establish the current-state baseline, assess maturity, identify gaps, define the target state and produce prioritized recommendations and a remediation roadmap.
• Use Microsoft Purview, Microsoft Defender for Cloud and relevant Microsoft security/compliance capabilities to support security posture reviews, benchmarking, control validation and actionable recommendations, subject to available licensing and access.
• Architect and govern secure Microsoft Azure and M365 solutions using native security controls, Microsoft Defender capabilities, identity governance and cloud security best practices.
• Perform and coordinate security and compliance risk assessments, control reviews and audit support across cloud and M365 environments; maintain risk, issue, action and evidence registers.
• Support internal and external audits, ensure timely closure of findings and compliance gaps, and provide clear management reporting on risks, exceptions, actions and control effectiveness.
• Align controls with applicable frameworks and regulations, including ISO 27001, NIST CSF, CSA Cloud Controls Matrix, COBIT 2019, GDPR, DORA, SOX ITGC and relevant organizational policies.
• Facilitate solution and control workshops, document high-level and detailed designs, define governance processes and RACI, and maintain current policies, procedures, control narratives and operating documentation.
• Provide strategic guidance for cloud security incidents, risk treatment and exception management, and coordinate with technical, business, legal, privacy, audit and service-management stakeholders.
• Drive project milestones, SLA adherence, governance cadence, escalation management and continuous service improvement; mentor delivery teams and build customer awareness of cloud security and GRC practices.