IT Security Consultant (GRC)

Mondo; New York (NY); Remote; USD 96,000 - 110,000; Part time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

401K

Job summary

Mondo is seeking a Senior GRC, Technical Controls & AI Risk to lead technical control reviews and risk remediation in a remote-capable environment. This role partners with security engineering, IAM, vulnerability management, and data protection teams.

The ideal candidate brings deep GRC knowledge with technical depth to assess controls and evidence quality, support regulatory assessments, and advance AI governance using NIST/ISO frameworks.

Qualifications

• 8-13 years of experience in cybersecurity GRC or related disciplines.
• Experience performing technical control assessments and testing across multiple cybersecurity domains.
• Strong knowledge of control design, operating effectiveness, evidence evaluation, risk analysis, issue management.
• Ability to interpret technical evidence from IAM, vulnerability, incident, cloud, application security.
• Experience with ServiceNow IRM, Hyperproof, or Vanta.

Responsibilities

• Conduct technical control reviews and assessments across cybersecurity domains.
• Design and execute control testing, evaluating design, operating effectiveness, scope, ownership, and evidence quality.
• Review and challenge audit evidence, system reports, tickets, configurations, testing results, and management assertions.
• Develop risk-based remediation plans with owners, milestones, dependencies, success criteria.
• Support internal and external audits and regulatory assessments.

Job description

Senior GRC, Technical Controls & AI Risk

Location-Type: Remote
Start Date Is: ASAP
Duration: (contract, perm, etc)6 Month Contract (option to extend or convert)
Compensation Range: $70-80/hour W2
Benefits: Eligible for Health, Dental, Vision, 401K
Must be authorized to work in the U.S. This position is not eligible for sponsorship

Position Summary

We are seeking a senior Governance, Risk and Compliance professional to lead technical control reviews, testing, evidence evaluation, risk analysis, and remediation planning across cybersecurity. This role will partner with security engineering, architecture, IAM, vulnerability management, incident response, cloud, application security, data protection, and business teams.

The ideal candidate is a strong GRC generalist with sufficient technical depth to understand how controls operate, challenge evidence, identify root causes, assess residual risk, and develop practical remediation plans. The role will also support AI governance and risk management.

Key Responsibilities

• Conduct technical control reviews and assessments across cybersecurity domains, including IAM, vulnerability management, security operations, incident response, cloud, infrastructure, application security, data protection, and third-party risk.
• Design and execute control testing, evaluating control design, operating effectiveness, scope, frequency, ownership, and evidence quality.
• Review and challenge audit evidence, system reports, tickets, configurations, testing results, and management assertions.
• Identify control gaps, deficiencies, recurring issues, exceptions, and root causes.
• Develop risk-based remediation plans with owners, milestones, dependencies, success criteria, and sustainable corrective actions.
• Assess inherent risk, control effectiveness, compensating controls, residual risk, and risk acceptance decisions.
• Support internal and external audits, regulatory assessments, customer assurance requests, and certification activities.
• Map requirements across NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, and applicable regulatory requirements.
• Develop and maintain policies, standards, control objectives, risk statements, assessment methodologies, and evidence requirements.
• Produce risk dashboards, control maturity assessments, issue and exception reporting, and executive recommendations.
• Improve control adoption, evidence quality, repeatable testing, and continuous monitoring using ServiceNow IRM, Hyperproof, and Vanta.
• Support AI governance, including AI use‑case assessments, AI risk and control matrices, responsible AI, model and data risks, third‑party AI, agentic AI, security, privacy, transparency, human oversight, and lifecycle governance.
• Apply ISO/IEC 42001 and the NIST AI Risk Management Framework to AI governance and control design.
• Advise technical and business stakeholders on risk trade‑offs, remediation options, and control requirements.

Required Qualifications

• 8-13 years of experience in cybersecurity GRC, IT risk, IT audit, internal controls, compliance, security assurance, or a related discipline.
• Experience performing technical control assessments and testing across multiple cybersecurity domains.
• Strong knowledge of control design, operating effectiveness, evidence evaluation, risk analysis, issue management, exceptions, and remediation planning.
• Ability to interpret technical evidence from IAM, vulnerability, incident, cloud, application security, infrastructure, and operational environments.
• Experience with NIST, ISO 27001, SOC 2, COBIT, or comparable frameworks.
• Strong written and verbal communication skills, including the ability to explain technical risk to business and executive stakeholders.
• Experience with ServiceNow IRM, Hyperproof, or Vanta.
• Preferred Qualifications
• CISA, CIA, CISSP, CRISC, CISM, or comparable certification; CISA, CIA, and CISSP are particularly desirable.
• Experience with ISO/IEC 42001, NIST AI RMF, AI governance, AI risk assessments, or AI control frameworks.
• Experience developing AI risk and control matrices or assessing AI use cases, models, data, vendors, and agentic AI implementations.
• Experience with control automation, continuous control monitoring, data analytics, or control‑as‑code concepts.
• Experience supporting global, regulated, or complex enterprise environments.