Security GRC - Principal Cyber Risk Advisor

ECI; Dallas (TX); On-site; USD 140,000 - 200,000; Full time

Job summary

ECI is seeking a Principal Cyber Risk Advisor to lead client advisory and program leadership across complex engagements, owning the work from policies to audits. You will drive multi-framework compliance programs, translate regulatory obligations into actionable programs, and act as a trusted strategic partner to executive leadership.

You will serve as a senior technical and advisory resource across client engagements, mentoring team members, and shaping GRC practices while coordinating with

Qualifications

• 7–10+ years of experience in information security, GRC, or IT risk.

Responsibilities

• Own and lead client advisory and program leadership across multiple engagements.
• Manage multi-framework compliance programs (CMMC, TISAX, NIST, ISO 27001, SOC 2, SEC).
• Develop and maintain client information security policy suites and procedures.

Job description

About ECI

ECI is the leading global provider of managed services, cybersecurity, and business transformation for mid-market financial services organizations across the globe. From its unmatched range of services, ECI provides stability, security and improved business performance, freeing clients from technology concerns and enabling them to focus on running their businesses. More than 1,000 customers worldwide with over $3 trillion of assets under management put their trust in ECI. At ECI, we believe success is driven by passion and purpose. Our passion for technology is only surpassed by our commitment to empowering our employees around the world.

Principal Cyber Risk Advisor

ECI is the leading global provider of managed services, cybersecurity, and business transformation for mid-market financial services organizations across the globe. From its unmatched range of services, ECI provides stability, security, and improved business performance — freeing clients from technology concerns and enabling them to focus on running their businesses. More than 1,000 customers worldwide with over $3 trillion of assets under management put their trust in ECI. At ECI, we believe success is driven by passion and purpose. Our passion for technology is only surpassed by our commitment to empowering our employees around the world.

THE OPPORTUNITY

As a Principal Cybersecurity Risk Advisor, you will work alongside industry leaders across verticals to strengthen client security postures, drive compliance programs, and act as a trusted strategic partner to executive leadership. This is not a delegation role — you will own the work: writing policies, conducting assessments, leading audits, and advising boards. This is not your typical consulting role. Since ECI is the primary third party to our clients you will be working with internal teams to own workflows.

You will serve as a senior technical and advisory resource across a portfolio of complex client engagements, leading multi-framework compliance programs (CMMC, TISAX, NIST, ISO 27001, SOC 2, SEC) and helping clients translate evolving regulatory obligations into prioritized, actionable programs. If you can't get your hands dirty, this role isn't for you.

What You Will Do

Client Advisory & Program Leadership

• Serve as a named senior advisor to client CTO, CISO, and executive leadership — owning strategic direction and day-to-day program execution across multiple engagements
• Lead steering sessions, quarterly program reviews, and board-level risk briefings — preparing and delivering materials directly
• Develop and maintain rolling GRC roadmaps aligned to client business priorities, regulatory calendars, and risk appetite
• Translate complex regulatory and technical requirements into actionable, prioritized guidance for operational, technical, and executive stakeholders
• Address ad hoc client security queries with timely, well-reasoned guidance, and build deep institutional knowledge of client environments, systems, and supply chains

Risk Management & Compliance

• Develop and implement risk management strategies, maintaining enterprise GRC risk registers with hands-on identification, scoring, treatment, and reporting
• Conduct thorough security architecture analyses, identifying vulnerabilities and proposing robust countermeasures; facilitate risk workshops and annual Security Program Reviews
• Manage multi-framework compliance programs concurrently — CMMC Level 2 (including SSP, POA&M, SRM, SPRS scoring, and C3PAO coordination), TISAX (ISA self-assessment, ISMS), ISO 27001 (SoA, Annex A mapping), and others as client needs dictate
• Own and drive full audit lifecycle management — pre-audit readiness, evidence collection, auditor liaison, post-audit remediation — across up to four certification engagements per year
• Develop, review, and maintain client information security policy suites and procedures; update policies against SEC, NIST, CMMC, FTSE, ISO 27001, and other applicable standards

Vendor Risk & M&A Due Diligence

• Own vendor due diligence programs including SOC 2 Type II analysis, security questionnaire reviews, risk scoring, and contractual flow-down verification
• Lead GRC due diligence workstreams on M&A acquisition targets — assessing security posture, compliance gaps, and integration risk; produce diligence reports and post-acquisition integration roadmaps

Mentorship & Practice Development

• Mentor team members, contributing to their professional growth and overall GRC practice capability
• Contribute to internal practice development — maintaining and improving compliance playbooks, templates, and methodologies informed by client engagement learnings
• Participate in internal QA and peer review processes to ensure quality and consistency across all client deliverables

Who You Are

• 7–10+ years of experience in information security, GRC, or IT risk, with a track record of continuous growth in a