GRC Cybersecurity Specialist

We Place People Executive Search Firm; Austin (TX); On-site; USD 110,000 - 140,000; Full time

Job summary

We Place People Executive Search Firm is seeking an experienced Cybersecurity Governance, Risk & Compliance Specialist II in Austin to lead governance, risk, and security program improvements. The role emphasizes governance decisions, ownership, and risk treatment across the organization, not just compliance.

The candidate will engage with technology and business leaders to translate requirements into actionable controls, support risk assessments, and manage third-party security reviews.

Qualifications

• Bachelor's degree or equivalent combination of education and experience.
• Approximately 5+ years of IT Security experience, including governance, risk, or GRC.
• At least 4 years of Information Security experience with exposure to technical security environments.
• Hands-on cybersecurity experience is strongly preferred.

Responsibilities

• Operate and mature the organization's cybersecurity governance program.
• Develop and maintain information security policies, standards, procedures, and governance docs.
• Work with teams to establish ownership and accountability for cybersecurity requirements.
• Translate policies into practical controls and operating processes.
• Provide guidance on security requirements and governance processes.
• Identify gaps and drive remediation.

Skills

Governance & Risk

Policy development

Security writing

Communication

Education

Bachelor's degree or equivalent

Tools

GRC platforms

Risk assessment tools

Job description

Job Description

Location: Austin, TX
Employment Type: Direct Hire / Full-Time
Work Arrangement: Onsite
Work Authorization: U.S. Citizen or Green Card Holder required

Our client is seeking an experienced Cybersecurity Governance, Risk & Compliance (GRC) Specialist II to join its Information Security organization in Austin.

This position is ideal for a cybersecurity professional who has done more than participate in audits, complete compliance checklists, or respond to security questionnaires. The successful candidate will have hands-on experience with cybersecurity governance and risk management and will understand how security programs are structured, governed, measured, and improved within a complex organization.

While compliance is an important component of the position, the strongest emphasis is on Governance and Risk. Candidates should be comfortable discussing how cybersecurity decisions are made, how accountability and ownership are established, how risk is identified and evaluated, and how policies, standards, exceptions, and risk-treatment decisions are managed across an organization.

What You'll Be Doing

Cybersecurity Governance

• Help operate and mature the organization's cybersecurity governance program.
• Develop, maintain, and improve information security policies, standards, procedures, and governance documentation.
• Work with security, technology, business, and leadership teams to establish clear ownership and accountability for cybersecurity requirements.
• Help ensure security policies and standards translate into practical controls and operating processes.
• Provide guidance to stakeholders on security requirements, governance processes, and appropriate security practices.
• Identify gaps between established security requirements and actual business or technology practices and help drive appropriate remediation.

Cybersecurity Risk Management

• Perform and support cybersecurity risk assessments across technology, business processes, vendors, applications, and services.
• Identify security risks, assess their potential business impact, and communicate findings clearly to both technical and non-technical stakeholders.
• Work with risk owners to determine appropriate remediation, mitigation, acceptance, transfer, or other risk-treatment strategies.
• Manage and evaluate security exception requests and help ensure accepted risks have appropriate ownership, documentation, approvals, and expiration or review dates.
• Track identified risks and remediation activities through resolution.
• Help leadership understand cybersecurity risk so informed business decisions can be made.

Third-Party & Client Security

• Conduct security reviews and risk assessments of vendors and third-party service providers.
• Manage remediation and follow-up activities associated with identified vendor risks.
• Support the ongoing third-party security risk management lifecycle.
• Lead or coordinate responses to client security questionnaires, assessments, and security-related inquiries.
• Gather and validate evidence demonstrating the effectiveness of security controls.
• Participate in client and third-party discussions as an Information Security subject matter expert.

Security Controls & Frameworks

• Evaluate technology environments and security programs against established cybersecurity frameworks, standards, and internal requirements.
• Work with frameworks and assessment methodologies including NIST, ISO 27001, SOC, and SIG.
• Assess whether controls are appropriately designed, implemented, documented, and operating as intended.
• Partner with technology and security teams to address control gaps and strengthen the organization's overall security posture.

AI Governance & Risk

• Support governance and risk management associated with Artificial Intelligence technologies and use cases.
• Evaluate AI-related security, governance, privacy, and technology risks.
• Help establish appropriate controls, standards, and risk-management practices for responsible AI adoption.
• Work with stakeholders to evaluate new AI capabilities from a cybersecurity and risk perspective.

Security Awareness & GRC Operations

• Support and help manage the organization's Security Awareness program, including planning, training evaluation, measurement, and continuous improvement.
• Support administration and optimization of GRC platforms, workflows, reporting, and risk records.
• Maintain accurate documentation and reporting related to risks, controls, exceptions, assessments, and remediation activities.
• Help improve GRC processes as the cybersecurity program continues to mature.

What We're Looking For

Education & Experience

• Bachelor's degree or equivalent combination of education and experience.
• Approximately 5+ years of IT Security experience, including meaningful experience within cybersecurity governance, risk, or GRC.
• At least 4 years of Information Security experience with exposure to technical security environments.
• Hands-on cybersecurity experience is strongly preferred.

Governance & Risk Experience – Critical

Candidates should be able to clearly explain their experience with:

• Cybersecurity governance structures and processes.
• Security policy and standards development.
• Roles, responsibilities, ownership, and accountability within a security program.
• Cybersecurity risk identification and assessment.
• Risk scoring, prioritization, remediation, and treatment.
• Risk acceptance and security exception processes.
• Translating technical security findings into business risk.
• Working with risk and control owners to drive issues through resolution.

We are particularly interested in candidates who understand why governance processes exist and how they influence cybersecurity decision-making, rather than candidates whose GRC experience has primarily consisted of compliance testing or audit support.

Additional Qualifications

• Strong working knowledge of NIST, ISO 27001, SOC, and SIG or comparable security frameworks and assessment methodologies.
• Experience performing third-party/vendor security assessments.
• Experience responding to client security questionnaires and security reviews.
• Experience with AI governance, AI security, or AI risk management.
• Strong technical writing skills with the ability to develop clear policies, standards, risk documentation, and executive-level communications.
• Experience working with GRC platforms and related workflow technologies.
• Understanding of role-based access controls and identity/security concepts.
• Working knowledge of security technologies and concepts such as authentication, encryption, firewalls, SIEM, IDS/IPS, vulnerability management, privileged access management, and mobile security.
• Ability to communicate cybersecurity risk effectively to both technical teams and business stakeholders.
• Strong analytical, organizational, project-management, and problem-solving skills.

Preferred certifications may include

CISSP, CISA, CISM, or relevant AI governance, audit, risk, or security credentials.

The Candidate We're Looking For

The right person will not view GRC as simply an audit or compliance function. We are looking for someone who understands that strong cybersecurity governance establishes how security decisions are made, who owns those decisions, how accountability is maintained, and how risk is evaluated and addressed.

You should be comfortable discussing real examples of situations where you identified a cybersecurity risk, worked with stakeholders to determine an appropriate response, documented or communicated that risk, and followed the issue through remediation or formal acceptance.

This is a highly collaborative position requiring the ability to work effectively with cybersecurity professionals, engineers, technology teams, business leaders, vendors, and clients.

This is a full-time, direct-hire position requiring onsite work in Austin. Candidates must be U.S. Citizens or Green Card holders.