GRC Risk Manager

Vervation; Houston (TX); Hybrid; USD 120,000 - 190,000; Full time

Job summary

Vervation LLC seeks a GRC Risk Manager to lead risk identification, control assessment, and governance across a client portfolio, intersecting traditional risk management with AI governance.

The ideal candidate will drive risk programs aligned to NIST CSF 2.0, CIS Controls, and NIST AI RMF, delivering board-ready risk briefs and hands-on control analyses.

Qualifications

• Bachelor-level degree in a cybersecurity related field.
• CISSP/CISM/CRISC or CGEIT and AI governance training a plus.
• Hands-on experience with NIST CSF/RMF and CIS Controls.

Responsibilities

• Lead risk identifications across client portfolios.
• Develop and maintain risk registers, treatment plans, and KRIs.
• Conduct CIS Controls gap analyses for SMB and enterprise clients.
• Map control deficiencies to business impact and remediation roadmaps.
• Support vCISO engagements with board-ready reporting.
• Facilitate tabletop exercises and risk scenario planning.

Skills

GRC

Risk assessments

NIST CSF

AI governance

Education

B.S. in Cybersecurity

Tools

CIS SecureSuite

CCISO

Job description

We are seeking a GRC Risk Manager to lead risk identification, control assessment, and governance initiatives across our client portfolio. This role operates at the intersection of traditional enterprise risk management and emerging AI governance — bridging frameworks like NIST CSF/RMF, CIS Controls, and NIST AI RMF to deliver actionable security posture improvements.

Requirements

Vervation LLC is a cybersecurity, AI automation, and enterprise architecture consultancy serving Fortune 500 clients. We are seeking a GRC Risk Manager to lead risk identification, control assessment, and governance initiatives across our client portfolio. This role operates at the intersection of traditional enterprise risk management and emerging AI governance — bridging frameworks like NIST CSF/RMF, CIS Controls, and NIST AI RMF to deliver actionable security posture improvements. The ideal candidate is equally comfortable presenting board-level risk briefings and conducting hands‑on control gap analyses.

Risk & compliance program management

Lead enterprise risk assessments aligned to NIST CSF 2.0 and CIS Controls IG1–IG3

Develop and maintain risk registers, treatment plans, and KRI dashboards

Conduct CIS Critical Security Controls gap analyses for SMB and enterprise clients

Map control deficiencies to business impact and remediation roadmaps

AI governance & emerging risk

Apply NIST AI RMF (Govern, Map, Measure, Manage) to client AI deployments

Assess AI system risks including bias, explainability, data provenance, and model drift

Develop AI use policies, acceptable use frameworks, and third‑party AI vendor risk reviews

Align AI governance posture to evolving regulatory guidance (EU AI Act, NIST)

vCISO advisory support

Support fractional CISO engagements with risk briefings and board‑ready reporting

Facilitate tabletop exercises and cyber risk scenario planning

Advise on security architecture decisions with a risk‑informed lens

Policy, audit & third‑party risk

Author and maintain security policies, standards, and control narratives

Manage vendor risk assessments and supply chain security reviews

Support SOC 2, ISO 27001, HIPAA, or CMMC audit preparation as applicable

Experience

5–8+ years in GRC, information security risk, or compliance roles

Demonstrated hands‑on experience with NIST CSF, NIST RMF, and CIS Controls

Prior work in Fortune 500, regulated industries, or consulting environments

Experience leading or supporting vCISO/advisory engagements preferred

Education & certifications

B.S. or higher in Cybersecurity, Information Systems, or related field

CISSP, CISM, CRISC, or CGEIT (one or more required)

NIST AI RMF Practitioner designation or equivalent AI governance training a plus

CIS SecureSuite or CCISO certification valued

About the Company

Vervation LLC is a cybersecurity, AI automation, and enterprise architecture consultancy serving Fortune 500 clients.