GRC Manager, vCISO Services

Point Solutions Security; Denver (CO); Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Ownership of client engagements

Flexible remote work

Executive-facing responsibilities

Professional development budgets

Collaborative senior team

Impactful security work

Job summary

Point Solutions Security (PSS) seeks a GRC Manager, vCISO Services to lead client governance and security programs. You’ll serve as the client-facing security leader for a portfolio of Cyber as a Service engagements, guiding governance meetings, risk reviews and executive briefings with PSS leadership backing your decisions.

You’ll drive SOC 2, ISO 27001 and CMMC efforts, including readiness, audits and control design, while coordinating evidence, policies and auditors.

Qualifications

• 7+ years in security, including 2+ in management.
• Active CISSP, CISM or CRISC certification.
• Deep hands‑on experience in SOC 2 / ISO 27001 or CMMC / NIST 800-171 assessments.
• Proven track record delivering measurable results to executives.
• Bonus: broader SOC 2/ISO and CMMC certifications or OT/utility experience.

Responsibilities

• Aspire to client success as the named vCISO for a portfolio of CaaS clients.
• Lead SOC 2 and ISO 27001 programs from readiness to audits, including evidence and coordination.
• Drive CMMC programs for defense contractors, including SSPs, POA&Ms and enclaves.
• Manage the GRC cycle: risk assessments, ISMS operations, and policy upkeep.
• Deliver on CaaS commitments with regular reviews and scenario exercises.
• Mentor and review work of a supporting analyst and refine playbooks.

Skills

GRC programs

Client leadership

SOC 2 / ISO 27001

CMMC / NIST

Executive briefing

Risk management

Team management

Job description

Point Solutions Security (PSS) protects the organizations communities depend on: water districts, government agencies, energy innovators, defense contractors and growing tech companies. We're hiring a GRC Manager, vCISO Services to be the client-facing vCISO and GRC lead for our Cyber as a Service (CaaS) clients. You'll do real work with real stakes, and help shape how PSS grows.

Type: Full-time, player-coach

Experience: 7+ years in information security, including 2+ in management

What you’ll do

• Own client success as vCISO: be the named security leader for a portfolio of Cyber as a Service clients, running governance meetings, briefing executives and boards, and owning each client's roadmap, with PSS leadership as your executive sponsor
• Lead SOC 2 and ISO 27001 programs: take clients from readiness and gap assessment through Type 1, Type 2 and certification audits, including scoping, control design, policies, evidence and auditor coordination
• Lead CMMC programs: take defense contractors from NIST 800-171 gap assessment to assessment-ready SSPs, POA&Ms and CUI enclave scoping, plus NIST CSF and IEC 62443 work for utility and public-sector clients
• Run the GRC cycle: risk assessments and registers, ISMS operations (Statement of Applicability, internal audits, management reviews), vendor risk and policy upkeep
• Hit your CaaS commitments: deliver each client's tier on schedule, from recurring control reviews and vulnerability management to tabletop exercises and compliance check-ins
• Lead the work, not just do it: direct a supporting analyst on evidence and documentation, review everything before it reaches the client, and sharpen PSS playbooks as you go

What you bring

• 7+ years in security, including at least 2 years managing a team, a security program or a portfolio of client engagements, in-house or as a consultant
• An active CISSP, CISM or CRISC
• Deep, hands‑on experience taking organizations through SOC 2 / ISO 27001 or CMMC / NIST 800-171 assessments and audits, and working knowledge of the other. We expect strong candidates to lean one way.
• A track record of delivering measurable results, with confidence in front of executives and writing that clients act on
• Bonus: depth in both SOC 2/ISO and CMMC, ISO 27001 Lead Implementer or Lead Auditor, CMMC RP/CCP, GICSP, OT/SCADA or utility experience, and Colorado roots

Why PSS

We're a small, senior team that takes security seriously and ourselves a little less so. Here's what that looks like:

• You own your clients. No micromanagement or layers of approval. You're trusted to build the relationship, make the call and run the engagement your way.
• Flexibility that’s real. Work where and when you do your best work. We care about outcomes and happy clients, not hours at a desk.
• Every week is different. A water district's SCADA network on Monday, a defence contractor's CMMC audit on Wednesday, a startup's board meeting on Friday.
• Your ideas ship. See a better way to deliver a service? Pitch it on Tuesday and build it on Thursday. You'll help shape what PSS becomes.
• People you'll actually like. We collaborate, swap war stories, celebrate wins and back each other up when an incident hits at 2 a.m.
• We invest in you. Budget for certifications, training and conferences, plus room to grow into a bigger leadership role as we scale.
• Work that matters. Your controls protect drinking water, power grids, defense supply chains and the people who rely on them.