Cyber GRC Specialist

Jobtailor; Washington (District of Columbia); On-site; USD 90,000 - 130,000; Full time

Job summary

Jobtailor in Washington, DC is seeking a senior cyber GRC professional to mature governance routines, manage risk registers, and coordinate audits and client due diligence with cross-functional teams. This role emphasizes translating security requirements into practical controls and enabling effective governance across multiple frameworks.

You will drive remediation, develop governance metrics, and deliver concise executive reporting while collaborating with security, compliance, Legal, and IT

Qualifications

• Bachelor's degree or equivalent professional experience in a relevant field preferred.
• 3-6 years of experience in cyber GRC, information security, technology risk, IT audit, compliance, or related control-management work preferred.
• Working knowledge of ISO 27001, SOC 2, NIST CSF, CIS Controls, SEC/FINRA expectations, privacy requirements, or comparable control frameworks.
• Experience supporting audits, evidence collection, control testing, policy updates, issue tracking, or risk-register maintenance in a regulated environment; financial services experience preferred.
• Knowledge of cyber risk registers, exception management, control testing, evidence management, policy lifecycle management, and audit coordination.

Responsibilities

• Support and mature cyber governance routines, including policy management, control ownership, risk acceptance, exception handling, standards maintenance, and leadership reporting
• Maintain the cyber risk register and document risk decisions, remediation plans, due dates, dependencies, and residual risk
• Administer and contribute process support to ISO and security-risk management platforms such as Vanta or similar tools
• Coordinate evidence collection, control testing, audits, client due diligence responses, regulatory requests, and compliance deliverables
• Translate ISO 27001, regulatory, client, and internal security expectations into practical controls and operating procedures
• Facilitate cross-functional communications for security change, SaaS inventory, policy enforcement, control adoption, and risk remediation
• Coordinate vulnerability management governance, including scan-result intake, prioritization, remediation tracking, exception handling, and reporting
• Partner with security engineers, infrastructure teams, application owners, Compliance, Legal, Operations, and Client Service to close control gaps
• Develop metrics for control effectiveness, audit readiness, exceptions, overdue remediation, and governance activities
• Identify process improvements to make security governance repeatable, transparent, and useful

Skills

Cyber Governance

ISO 27001 Knowledge

Risk Management

GRC Platforms Experience

Control Testing

Policy Management

Audit Coordination

Education

Bachelor's degree or equivalent

Tools

Vanta

Archer

ServiceNow GRC

OneTrust

Drata

Job description

• Support and mature cyber governance routines, including policy management, control ownership, risk acceptance, exception handling, standards maintenance, and leadership reporting
• Maintain the cyber risk register and document risk decisions, remediation plans, due dates, dependencies, and residual risk
• Administer and contribute process support to ISO and security-risk management platforms such as Vanta or similar tools
• Coordinate evidence collection, control testing, audits, client due diligence responses, regulatory requests, and compliance deliverables
• Translate ISO 27001, regulatory, client, and internal security expectations into practical controls and operating procedures
• Facilitate cross-functional communications for security change, SaaS inventory, policy enforcement, control adoption, and risk remediation
• Coordinate vulnerability management governance, including scan-result intake, prioritization, remediation tracking, exception handling, and reporting
• Partner with security engineers, infrastructure teams, application owners, Compliance, Legal, Operations, and Client Service to close control gaps
• Develop metrics for control effectiveness, audit readiness, exceptions, overdue remediation, and governance activities
• Identify process improvements to make security governance repeatable, transparent, and useful

Requirements

• Bachelor's degree in cyber security, information systems, risk management, business, or a relevant field preferred; equivalent professional experience will be considered
• 3-6 years of experience in cyber GRC, information security, technology risk, IT audit, compliance, or related control-management work preferred
• Working knowledge of ISO 27001, SOC 2, NIST CSF, CIS Controls, SEC/FINRA expectations, privacy requirements, or comparable control frameworks
• Experience supporting audits, evidence collection, control testing, policy updates, issue tracking, or risk-register maintenance in a regulated environment; financial services experience preferred
• CISA, CRISC, CISM, Security+, ISO 27001 Foundation/Lead Implementer, or similar professional designation preferred but not required
• Knowledge of cyber risk registers, exception management, control testing, evidence management, policy lifecycle management, and audit coordination
• Experience with GRC or trust-management platforms such as Vanta, Archer, ServiceNow GRC, OneTrust, Drata, or similar tools
• Knowledge of vulnerability management governance, prioritization, remediation tracking, aging analysis, exception workflows, and executive reporting
• Strong knowledge of cyber security controls across identity, endpoint, cloud, network, data protection, application security, and third-party risk
• Excellent writing, facilitation, and stakeholder-management skills
• Ability to translate technical risk into clear business language
• Practical judgment in enforcing, escalating, and developing workable control paths
• Ability to take ownership and move initiatives forward without constant oversight
• Ability to balance technical depth, process discipline, and business judgment
• Ability to communicate clearly with technical and non-technical colleagues
• Must be authorized to work in the United States without current or future employer-sponsored work authorization

Core Competencies

Demonstrates expertise in cyber governance, risk management, and compliance, with a strong focus on ISO 27001 and related frameworks. Capable of translating complex security requirements into actionable controls while facilitating cross-functional collaboration and effective communication.

Highest-signal resume keywords

• Cyber Governance
• ISO 27001 Knowledge
• Risk Management
• GRC Platforms Experience
• Control Testing

ATS Optimization Keywords

Hard Skills

• Cyber Risk Management
• Policy Management
• Control Ownership
• Audit Coordination
• Evidence Collection
• Vulnerability Management
• Risk Register Maintenance
• Technical Risk Translation
• Control Effectiveness Metrics
• Compliance Deliverables

Soft Skills

• Excellent Writing
• Facilitation Skills
• Stakeholder Management
• Practical Judgment
• Clear Communication

Certifications & Qualifications

• CISA
• CRISC
• CISM
• Security+
• ISO 27001 Foundation/Lead Implementer

Industry Keywords

• Cyber Security
• Information Security
• Technology Risk
• IT Audit
• Compliance
• Financial Services
• SOC 2
• NIST CSF
• CIS Controls
• SEC/FINRA Expectations

Tools & Technologies

• Vanta
• Archer
• ServiceNow GRC
• OneTrust
• Drata