Cyber GRC Specialist: Policy, Risk & Audit

Brown Advisory; Washington (District of Columbia); On-site; USD 105,000 - 127,000; Full time

Benefits offered by this job

Medical

Dental

Vision

Wellness program participation

Job summary

Brown Advisory is seeking a Cyber GRC Specialist to mature governance routines, manage policy ownership, risk tracking, and audit readiness within a lean security team. The role emphasizes translating security requirements into practical programs, coordinating evidence, and reporting on controls.

The ideal candidate has 3–6 years of cyber GRC experience, knowledge of ISO 27001/NIST, and experience with multiple GRC platforms. DC-based, full-time with strong collaboration across departments.

Qualifications

• Bachelor's degree in cyber security, information systems, risk management, business preferred or equivalent experience.
• 3–6 years of experience in cyber GRC, information security, technology risk, IT audit, compliance, or related control-management work.
• Knowledge of ISO 27001, SOC 2, NIST CSF, CIS Controls, SEC/FINRA expectations, privacy requirements or similar.
• Experience supporting audits, evidence collection, control testing, policy updates, issue tracking or risk-register maintenance in regulated environments.
• Professional designations (CISA, CRISC, CISM, Security+, ISO 27001) preferred but not required.

Responsibilities

• Support and mature cyber governance routines: policy management, control ownership, risk acceptance, exceptions and governance reporting.
• Maintain cyber risk register and document risk decisions, remediation plans, due dates and dependencies.
• Administer ISO and security-risk platforms (Vanta, Archer, ServiceNow GRC, OneTrust, Drata).
• Coordinate evidence collection, control testing, audit requests and regulatory responses.
• Translate security expectations into practical controls and operating procedures.
• Facilitate cross-functional communications for security changes and policy enforcement.
• Coordinate vulnerability governance: scan intake, prioritization, remediation tracking and reporting.
• Collaborate with security engineers, IT, Compliance, Legal, Operations and Client Service to close control gaps.
• Develop metrics for control effectiveness and audit readiness.
• Identify process improvements for governance repeatability and transparency.

Skills

Cyber risk management

Stakeholder management

Policy communication

Writing and facilitation

Continuous improvement

Education

Bachelor's degree in cyber security, information systems, risk management, business

Tools

Vanta

Archer

ServiceNow GRC

OneTrust

Drata

Job description

Brown Advisory is seeking a Cyber GRC Specialist to mature governance routines, manage policy ownership, risk tracking, and audit readiness within a lean security team. The role emphasizes translating security requirements into practical programs, coordinating evidence, and reporting on controls.

The ideal candidate has 3–6 years of cyber GRC experience, knowledge of ISO 27001/NIST, and experience with multiple GRC platforms. DC-based, full-time with strong collaboration across departments.