Senior Cyber Security & GRC Engineer

Emergent; United States; On-site; USD 140,000 - 210,000; Full time

Job summary

Emergent, LLC is seeking an experienced Cyber Security & GRC Engineer to lead an enterprise-wide program across a multi-entity organization. You will design a harmonized control framework and drive governance with executives and auditors.

You will own SOX ITGC readiness, GDPR program operationalization, and risk management activities while guiding security architecture and awareness initiatives across cloud and on‑prem environments.

Qualifications

• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or equivalent experience.
• 7 years of information security, cybersecurity, or risk management experience with progression into senior program ownership responsibilities.
• Hands-on experience administering a GRC platform, preferably Vanta.
• Experience implementing, operating, or auditing against NIST CSF, SOX ITGC, and GDPR requirements.
• Certifications: CISSP, CISM, CRISC, or CISA.
• Excellent communication with auditors, executives, and technical teams.

Responsibilities

• Own and mature the enterprise cybersecurity and risk management program across a multi-entity organization.
• Design, implement, and maintain a harmonized control framework supporting NIST CSF 2.0, GDPR, and SOX ITGC requirements.
• Lead governance activities including risk reviews, KPI/KRI reporting, and steering committee meetings.
• Serve as primary liaison for auditors, assessors, clients, and internal stakeholders on security and compliance.
• Administer and optimize Vanta as the enterprise GRC system of record.
• Configure controls, tests, evidence collection, continuous monitoring, and audit workflows in Vanta.
• Develop, maintain, and manage enterprise security policies, standards, procedures, and policy lifecycle processes.
• Lead SOX ITGC readiness and compliance efforts.
• Operationalize GDPR requirements including DPIAs and breach response.
• Conduct NIST CSF 2.0 assessments, maturity reviews, gap analyses, and remediation planning.
• Manage risk assessments, risk registers, and third-party vendor risk programs.
• Oversee vulnerability management, patching, and access reviews across cloud and on-prem environments.
• Lead incident response activities and post-incident reviews.
• Provide security architecture guidance for new systems and data platforms.
• Build security awareness and phishing simulation programs.
• Collaborate with business teams to embed security and privacy into solution design.

Skills

Cloud security

Identity management

Vanta administration

Security policies

Auditing & governance

Communication with leadership

Education

Bachelor's degree in CS/IS/Cybersecurity

Tools

Vanta

Job description

Emergent, LLC is seeking an experienced Cyber Security & GRC Engineer to lead and mature an enterprise-wide cybersecurity, governance, risk, and compliance program. This senior-level role involves developing a unified security and compliance framework while engaging with stakeholders and managing risks across multiple organizations.

Responsibilities

• Own and mature the enterprise cybersecurity and risk management program across a multi-entity organization
• Design, implement, and maintain a harmonized control framework supporting NIST CSF 2.0, GDPR, and SOX ITGC requirements
• Lead enterprise governance activities, including risk reviews, KPI/KRI reporting, executive reporting, and steering committee meetings
• Serve as the primary liaison for auditors, assessors, clients, and internal stakeholders regarding security and compliance matters
• Administer and optimize Vanta as the enterprise GRC system of record
• Configure controls, integrations, tests, evidence collection, continuous monitoring, and audit workflows within Vanta
• Develop, maintain, and manage enterprise security policies, standards, procedures, exceptions, and policy lifecycle processes
• Lead SOX ITGC readiness and compliance efforts
• Operationalize GDPR requirements, including records of processing, DPIAs, data subject rights management, vendor oversight, and breach response
• Conduct NIST CSF 2.0 assessments, maturity reviews, gap analyses, and remediation planning
• Manage enterprise risk assessments, risk registers, third-party vendor risk programs, and remediation initiatives
• Oversee vulnerability management, patch coordination, access reviews, and technical security controls across cloud and on-premises environments
• Lead incident response activities, including preparation, detection, containment, recovery, and post-incident reviews
• Provide security architecture guidance for new systems, integrations, cloud solutions, and data platforms
• Build and manage security awareness, phishing simulation, and employee training programs
• Partner with business and project teams to ensure security and privacy requirements are incorporated into solution design

Requirements

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or equivalent experience
• 7 years of information security, cybersecurity, or risk management experience with progression into senior program ownership responsibilities
• Hands-on experience administering a GRC platform, preferably Vanta
• Experience implementing, operating, or auditing against NIST CSF, SOX ITGC, and GDPR requirements
• Demonstrated success developing and implementing security policies, controls, and governance programs
• One or more of the following certifications: CISSP, CISM, CRISC, or CISAStrong technical knowledge of cloud security, identity and access management, endpoint security, vulnerability management, logging, and security operations
• Excellent communication skills with the ability to engage technical teams, business leaders, auditors, and executives
• Proven ability to work independently, manage multiple priorities, and drive accountability across stakeholders
• Direct Vanta administration experience
• Experience supporting a publicly traded company and SOX Section 404 compliance requirements
• Experience leading security programs across multiple organizations or business entities
• ISO 27001 Lead Implementer or Lead Auditor certification
• SANS/GIAC certifications
• Construction, engineering, energy, power generation, or EPC industry experience
• Familiarity with AI/ML governance, data security, and secure AI deployment practices