Information Security Consultant

Remote; San Francisco (CA); Remote; USD 110,000 - 160,000; Full time

Benefits offered by this job

Fully remote working within India

23 days annual leave + 10 Indianpublic

One additional paid day off for your/b

Healthcare insurance

Mental health & wellbeing platform

£2,000 professional development budget

Referral bonus up to £2,000

Job summary

Partner Company is seeking an Information Security Consultant to join a GRC team and support organizations in strengthening their cybersecurity posture. You will deliver a broad range of consulting engagements, from compliance assessments to ongoing security advisory, working with clients at different maturity levels and across diverse industries in a fully remote setup.

You will guide audit preparations, develop remediation plans, and provide risk-based recommendations, while building strong

Qualifications

• 2–5 years of experience in information security, cybersecurity, risk management, compliance, or GRC.
• Experience with external client engagements and security improvement initiatives.
• Familiarity with ISO 27001, SOC 2, or NIST.
• Understanding of security controls, risk management, and security operations.
• Experience supporting compliance activities and security programmes.
• Strong written and verbal communication skills for client discussions and workshops.
• Ability to manage multiple clients and priorities in a remote setting.
• Proactive, self-managing, and able to work in a fully remote environment.
• Willingness to continuously learn and take on more responsibility.

Responsibilities

• Deliver governance, risk, and compliance engagements aligned with ISO 27001, SOC 2, NIST, and regional standards.
• Conduct gap analyses, security posture assessments, and maturity reviews.
• Design and implement security programmes, policies, and control frameworks.
• Guide clients through audits, certification processes, and external security assessments.
• Provide ongoing security advisory and vCISO-style support.
• Lead client meetings, workshops, and risk assessment sessions.
• Translate security requirements into clear recommendations for stakeholders.
• Build trusted client relationships and raise risks or blockers proactively.
• Produce high-quality client deliverables and maintain consulting standards.

Skills

Information security

Client-facing

ISO 27001

SOC 2

NIST

Communication skills

Remote work

Tools

Vanta

Drata

OneTrust

Job description

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for an Information Security Consultant based in India.

We are looking for a motivated Information Security Consultant to join a Governance, Risk, and Compliance (GRC) team and support organizations in strengthening their cybersecurity posture. In this role, you will deliver a broad range of consulting engagements, from compliance assessments and certification projects to ongoing security advisory and risk management. You will work with clients at different stages of security maturity, helping them build effective programmes and address practical security challenges. Combining technical knowledge with strong consulting and communication skills, you will translate complex requirements into clear, actionable recommendations. This fully remote opportunity offers exposure to diverse industries, international clients, and opportunities to develop your expertise while taking ownership of meaningful projects.

Accountabilities

• Deliver governance, risk, and compliance engagements aligned with recognized frameworks, including ISO 27001, SOC 2, NIST, and relevant regional standards.

• Conduct gap analyses, security posture assessments, and maturity reviews to identify weaknesses and improvement opportunities.

• Design and implement security programmes, policies, procedures, risk registers, and control frameworks tailored to client requirements.

• Guide clients through audit preparation, certification processes, and external security assessments.

• Develop practical remediation plans and monitor progress to ensure identified gaps are addressed effectively.

• Provide ongoing security advisory services, including virtual CISO (vCISO)-style support and security programme improvement.

• Evaluate existing security programmes, risk management practices, controls, and operational processes, recommending realistic improvements.

• Help clients prioritize security initiatives based on risk exposure, business objectives, and available resources.

• Lead client meetings, workshops, and risk assessment sessions, engaging with technical teams, operational staff, and senior leadership.

• Translate technical security and compliance requirements into clear recommendations that different stakeholders can understand and act upon.

• Build trusted client relationships by asking insightful questions, constructively challenging assumptions, and communicating risks and trade-offs.

• Take ownership of client engagements and workstreams from planning through delivery, managing multiple priorities and raising risks or blockers proactively.

• Produce accurate, high-quality client deliverables and maintain consistent consulting standards.

• Use GRC platforms such as Vanta and contribute to scoping and shaping additional client projects.

• Share knowledge and expertise with colleagues while supporting the continuous development of the wider GRC team.

Requirements:

• 2–5 years of experience in information security, cybersecurity, risk management, compliance, or governance, risk, and compliance (GRC).

• Previous consulting or other client-facing experience, ideally supporting external organizations with compliance, assurance, or security improvement initiatives.

• Practical experience working with at least one recognized security framework, such as ISO 27001, SOC 2, or NIST.

• Working understanding of how security controls, risk management, and security operations function in practice, beyond theoretical framework requirements.

• Experience supporting compliance activities, security assessments, or the development and improvement of security programmes.

• Strong written and verbal communication skills, including confidence in leading client discussions, workshops, and assessment sessions.

• Ability to manage multiple clients and competing priorities in a structured and organized manner.

• Confidence working with both technical and non-technical stakeholders, including senior decision-makers.

• Proactive and self-managing approach, with the ability to work effectively in a fully remote environment.

• Strong analytical and problem-solving skills, sound professional judgment, and the ability to provide practical, risk-based recommendations.

• Willingness to continuously learn, develop consulting capabilities, and take on increasing responsibility.

Desirable skills and experience:

• Experience guiding organizations through security certification or external audits.

• Background in vCISO services, security advisory, or ongoing security programme management.

• Familiarity with GRC platforms such as Vanta, Drata, or OneTrust.

• Knowledge of regional security and compliance frameworks, such as NIST SP 800-53, NIST SP 800-171, FedRAMP, or CMMC in the US; Cyber Essentials or CAF in the UK; POPIA in South Africa; or the DPDP Act in India.

• Relevant professional certifications, such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISMP, CISA, CISM, or CISSP.

Benefits:

• Fully remote working arrangement within India.

• Annual leave of 23 days, in addition to 10 Indian public holidays (five national holidays and five state holidays of your choice).

• One additional paid day off for your birthday.

• Individual healthcare insurance coverage.

• Access to an employee mental health and wellbeing platform.

• Annual professional development and training budget of £2,000.

• Referral bonus of up to £2,000 for each successful referral.

• Collaborative working environment with opportunities to contribute to varied cybersecurity projects.

• Opportunities for continuous professional development and career growth within GRC consulting.