Principal Consultant – GRC

Nueva; Manila; On-site; PHP 1,200,000 - 1,800,000; Full time

Job summary

Nueva is seeking an experienced Principal Consultant in GRC to lead client engagements across audit, risk management and regulatory compliance from our Manila office. You will assess and implement industry standards and frameworks (ISO 27001, NIST CSF, COBIT, GDPR) and advise on building resilient, secure and compliant operating environments for global clients.

The role requires mentoring junior consultants, engaging senior stakeholders, and contributing to practice development while delivering

Qualifications

• Proven experience in GRC consulting within professional services or consulting firms.
• Auditing and implementing security frameworks (ISO 27001, NIST CSF, SOC 2, COBIT, PCI DSS).
• Experience in business resilience planning (BCP/DRP) and risk assessments.

Responsibilities

• Lead audits and assessments against industry standards and frameworks.
• Drive end-to-end implementation of governance and compliance frameworks.
• Advise on business resilience including BCP/DRP testing.
• Lead risk management activities including: enterprise risk assessments, risk identification, analysis and mitigation planning.
• Conduct threat modelling to identify potential vulnerabilities and control gaps.
• Manage and assess third-party/vendor risk, including due diligence and ongoing monitoring.
• Provide expertise in privacy and data protection, including GDPR compliance and data governance frameworks.
• Develop and review policies, procedures and control frameworks.
• Engage with senior stakeholders to provide strategic advice and recommendations.
• Mentor junior consultants and contribute to practice development.

Skills

GRC consulting

Audit

Risk management

Regulatory compliance

ISO 27001

NIST CSF

COBIT

Privacy regulations

Job description

We are seeking an experienced Principal Consultant in GRC to lead client engagements across audit, risk management and regulatory compliance. This role will focus on assessing and implementing industry standards and frameworks, while advising clients on building resilient, secure and compliant operating environments.

Key Responsibilities:

• Lead and deliver audits and assessments against industry standards and frameworks (e.g., ISO 27001, NIST CSF, COBIT, ISO 31000, ISO 22301, SOC 2, PCI DSS, GDPR, etc.)
• Drive end-to-end implementation of governance and compliance frameworks, aligning with business objectives, with deep expertise in ISO/IEC 27001 and ISMS delivery.
• Advise clients on business resilience, including development and testing of: Business Continuity Plans (BCP) & Disaster Recovery Plans (DRP)
• Lead risk management activities, including: Enterprise risk assessments & Risk identification, analysis and mitigation planning,
• Conduct threat modelling to identify potential vulnerabilities and control gap
• Manage and assess third-party/vendor risk, & including due diligence and ongoing monitoring
• Provide expertise in privacy and data protection, including: GDPR compliance, Notifiable Data Breach (NDB) requirements, & Data governance frameworks and controls
• Develop and review policies, procedures and control frameworks
• Engage with senior stakeholders to provide strategic advice and recommendations
• Mentor junior consultants and contribute to practice development

Key Requirements:

• Proven experience in GRC consulting, ideally within a professional services or consulting firm
• Strong experience in auditing and implementing security and compliance frameworks/standards (e.g., ISO 27001, NIST CSF, SOC 2, COBIT, PCI DSS, etc)
• Hands-on experience in business resilience planning (BCP/DRP)
• Deep understanding of risk management frameworks and methodologies
• Experience in threat modelling and security risk assessments
• Strong knowledge of third-party risk management practices
• Expertise in privacy regulations and data protection, including GDPR and data breach obligations
• Experience in data governance and information security controls
• Strong stakeholder management and communication skills

Preferred:

• Experience working across multiple industries, including global engagements.
• Ability to lead large, complex engagements
• Commercial awareness and experience supporting business development