Lead Consultant, Sensitive Data Compliance

Forvis Mazars US; Charlotte (NC); On-site; USD 120,000 - 180,000; Full time

Job summary

Forvis Mazars US seeks a Sensitive Data Compliance Lead Consultant to drive PCI DSS and sensitive data compliance assessments for enterprise clients, including Fortune 1000 and DoD contractors.

You will work with Cyber Compliance leadership to expand services, perform risk assessments against NIST and FedRAMP, and guide teams in implementing SSPs, policies, and POAMs.

Qualifications

• Bachelor's degree in cybersecurity, MIS, CS or similar.
• PCI QSA credential.
• Cybersecurity certifications (CISSP/CISA/CISM) preferred.
• Experience with federal cyber compliance frameworks (NIST 800-171, FISMA, FedRAMP).
• Knowledge of cyber risk management frameworks (NIST CSF, NIST SP 800-53, ISO 27001/27002).
• 5+ years in cybersecurity, IT audit, or GRC; 1–2 of PCI DSS, CSF, ISO 27001/27002, FedRAMP, FISMA, CIS CSC.

Responsibilities

• Lead PCI compliance assessments and sensitive data compliance assessments for enterprise clients.
• Assess IT environments and document gaps with reporting and recommendations.
• Support risk and compliance assessments against federal cyber frameworks (NIST, FedRAMP, CSF).
• Maintain and advance PCI and evolving cybersecurity compliance frameworks.
• Collaborate with consulting teams on clients across industries to define scope and develop SSPs, policies, and POAMs.
• Manage multiple projects concurrently to meet schedules and budgets.

Skills

PCI QSA

CISSP

CISA

CISM

Education

Bachelor's degree in Cybersecurity or related field

Job description

Description & Requirements

The Sensitive Data Compliance Lead Consultant role at FORVIS MAZARS working with the Sensitive Data Cyber Compliance leadership to define, refine and expand the firm's practice areas and services offerings. This role will be primarily focused on supporting PCI DSS projects with clients of all size, complexity, and industry, including international and Fortune 1000 companies, and U.S. Department of Defense contractors.

The Sensitive Data Compliance Lead Consultant role at FORVIS MAZARS working with the Sensitive Data Cyber Compliance leadership to define, refine and expand the firm's practice areas and services offerings. This role will be primarily focused on supporting PCI DSS projects with clients of all size, complexity, and industry, including international and Fortune 1000 companies, and U.S. Department of Defense contractors.

What You Will Do

• Lead and execute PCI compliance related assessments and sensitive data compliance assessments for enterprise clients by identifying key risks and gaps and documenting clear reporting with proof-of-concept and recommendations.
• Help execute information security risk and compliance assessments against federal and other government required cyber frameworks, NIST 800-171, NIST 800-53, FedRAMP, and the NIST Cybersecurity Framework, among others.
• Assesses IT environments and identifies gaps and vulnerabilities that impair compliance with required standards and assists with the documenting of clear reporting with proof-of-concept and recommendations.
• Help the IT Risk & Compliance team maintain industry leading solutions for PCI and other evolving cybersecurity compliance frameworks but pursuing continuing education.
• Participate on consulting teams with large enterprise clients in multiple industries to:
  • Assist organizations with defining boundaries of in-scope systems.
  • Assisting clients with documentation development, including system security plans (SSP), policies/procedures, strategy development, and plans of action and milestones (POAMs).
  • Define and integrate solutions, including tools, processes, and data flows to maintain required compliance obligations and reduce cyber risk.
• Effectively manage multiple projects concurrently, helping define and drive project management to keep projects on schedule and within budget.

Minimum Qualifications

• Bachelor's Degree in Cybersecurity, MIS, Computer Science, or a similar discipline
• Payment Card Industry Qualified Security Assessor (PCI QSA) credential.
• Cybersecurity and/or privacy‑related certifications (e.g. CISSP, CISA, CISM, preferred).
• Experience providing consulting, assessment, or implementation services associated with federal cyber compliance frameworks, including NIST 800-171, FISMA, or FedRAMP.
• Working knowledge of cyber risk management frameworks (CMMC / NIST 800-171, FISMA, FedRAMP, NIST Cybersecurity Framework, NIST SP 800-53)
• At least 5 years of experience in cybersecurity, IT audit, or governance, risk, and compliance required, including 1 - 2 of the following frameworks:
  • Payment Card Industry Data Security Standard (PCI DSS)
  • NIST Cybersecurity Framework (CSF)
  • ISO 27001 / 27002
  • FedRAMP / StateRAMP
  • FISMA and NIST SP 800-53
  • CIS Critical Security Control

About Forvis Mazars, LLP

Forvis Mazars, LLP is an independent member of Forvis Mazars Global, a leading global professional services network. Ranked among the largest public accounting firms in the United States, our 7,000+ team members deliver assurance, tax, and consulting services to clients in all 50 states and internationally.

With a legacy spanning more than 100 years, we're building something different. We are guided by a shared promise: Together, we create extraordinary experiences. That means delivering an Unmatched Client Experience® while creating a workplace where relationships matter, learning fuels growth, and every person feels valued and supported to thrive.

What We Offer

Our robust total rewards program and flexible work environment reflect our commitment to people, careers, and well‑being-empowering our team to grow and thrive while delivering exceptional service. To explore what makes working at Forvis Mazars special, visit www.forvismazars.us/careers.

Legal Notice

Forvis Mazars, LLP is an equal opportunity/affirmative action employer in accordance with applicable law. Employment selection and related decisions are made without regard to age, race, color, sex, sexual orientation, national origin, religion, genetic information, disability, protected veteran status, gender identity, or other protected classifications.

It is Forvis Mazars, LLP standard policy not to accept unsolicited referrals or resumes from any source other than directly from candidates.

Forvis Mazars, LLP expressly reserves the right not to consider any unsolicited referrals, resumes or CVs from vendors including and without limitation, search firms, staffing agencies, fee‑based referral services, and recruiting agencies.

Forvis Mazars, LLP further reserves the right not to pay a fee to a recruiter or recruiting agency unless such recruiter or recruiting agency has a signed vendor agreement with Forvis Mazars, LLP. Any resume(s) or CV(s) submitted to anyone working for Forvis Mazars, LLP, or submitted to a Forvis Mazars, LLP general email, without having a Forvis Mazars, LLP vendor agreement in place, will be considered the property of Forvis Mazars, LLP.