Senior GRC Consultant

Jobgether; United States; Remote; USD 90.000 - 140.000; Vollzeit

Benefits dieser Stelle

Remote work (Canada)

Contract role

PT schedule

Career growth

Direct exposure to leaders

Zusammenfassung

Jobgether is seeking an experienced GRC consultant to lead end-to-end compliance readiness and implementation engagements across SOC 2 Type I & II, ISO 27001, HIPAA, and privacy regulations in the US. You will manage evidence collection, risk assessments, and control mapping across frameworks while coordinating with client executives.

You'll work with Vanta, Drata, and similar platforms, conduct audits, and develop reusable knowledge bases.

Qualifikationen

• 5–7+ years in Governance, Risk and Compliance (GRC) or security auditing.
• Consulting or professional services experience managing multiple client engagements.
• Hands-on with SOC 2 Type I & II and ISO 27001/27002; audit readiness.
• Experience with GDPR, CCPA/CPRA or HIPAA.
• Ability to map controls across frameworks and build compliant programs.
• Strong understanding of cloud security, IAM, CI/CD pipelines and security controls.
• Excellent documentation and technical writing; fluent professional English.

Aufgaben

• Lead end-to-end compliance readiness and implementation for SOC 2, ISO 27001, HIPAA, and privacy laws.
• Manage and optimize GRC platforms (Vanta, Drata) for continuous monitoring and evidence collection.
• Perform risk assessments using NIST-style methods and translate findings to business risks.
• Design and maintain GRC programs, policies, control matrices, and evidence management.
• Conduct internal audits, identify gaps, and drive remediation plans.
• Coordinate vendor security assessments and client-facing questionnaires.
• Engage client executives, lead meetings, and manage stakeholder expectations.
• Produce high-quality deliverables: policies, risk registers, control mappings, reports.
• Coordinate with external auditors and support audit lifecycles.

Kenntnisse

GRC

Regulatory compliance

Auditing

Consulting

Client management

SOC 2

ISO 27001

GDPR/CCPA/ HIPAA

Cloud security

IAM

CI/CD security

GRC tools

Tools

Vanta

Drata

Jobbeschreibung

Accountabilities:

• Lead end-to-end compliance readiness and implementation engagements covering SOC 2 Type I and II, ISO 27001, HIPAA, U.S. state privacy regulations, and UK/EU GDPR.


• Manage and optimize GRC platforms such as Vanta, Drata, and similar tools, ensuring continuous compliance monitoring and accurate evidence collection.


• Conduct formal risk assessments using methodologies such as NIST 800-30, translating technical vulnerabilities and findings into actionable business and compliance risks.


• Design, implement, and maintain comprehensive GRC programs, including security policies, control frameworks, risk management processes, and evidence management procedures.


• Perform internal audits and assess control design and operational effectiveness, identifying gaps and recommending appropriate remediation measures.


• Coordinate vendor security assessments and questionnaires, collaborating with internal subject matter experts and developing reusable knowledge bases.


• Build and maintain strong relationships with client executives and stakeholders, leading recurring meetings, communicating progress, and managing expectations throughout each engagement.


• Prepare high-quality client deliverables, including policies, procedures, risk registers, control matrices, evidence packages, and assessment reports.


• Coordinate with external auditors and support clients throughout the audit lifecycle, ensuring timely delivery of documentation and successful completion of assessments.

Requirements:

• 5–7+ years of hands‑on experience in Governance, Risk, and Compliance (GRC), regulatory compliance, or information security auditing.


• Previous experience in consulting or professional services, with the ability to independently manage multiple client engagements simultaneously.


• Strong practical expertise in SOC 2 Type I and II and ISO 27001/ISO 27002 frameworks, including implementation, control mapping, and audit readiness.


• Experience working with additional regulatory or compliance frameworks, such as GDPR, CCPA/CPRA, or HIPAA.


• Proven ability to develop and implement compliance programs from the ground up and map controls across multiple frameworks.


• Solid technical understanding of cloud security, identity and access management (IAM), CI/CD pipelines, and security controls.


• Hands‑on experience with GRC platforms such as Vanta, Drata, or equivalent solutions.


• Excellent documentation, analytical, and technical writing skills, with the ability to produce clear and comprehensive compliance deliverables.


• Strong communication and stakeholder management skills, with professional‑level English and confidence leading meetings with U.S.-based clients.


• Ability to work independently, prioritize competing deadlines, and demonstrate ownership across multiple client engagements.

Nice to Have:

• Experience working directly with external auditors throughout certification and compliance assessments.


• Hands‑on experience implementing GDPR or U.S. privacy compliance programs.


• Familiarity with ISO 42001 (AI Management Systems).


• Relevant professional certifications, such as CISA, CISM, CRISC, ISO 27001 Lead Auditor, ISO 27001 Lead Implementer, or equivalent qualifications.

Benefits:

• Long-term independent contractor opportunity with a full‑time workload.


• 100% remote work arrangement, offering flexibility to work from anywhere in Canada.


• Opportunity to join an early‑stage, fast‑growing cybersecurity and compliance consulting environment.


• Direct exposure to founders, executive stakeholders, and client leadership teams.


• Significant autonomy and ownership over high‑impact client engagements from start to finish.


• Opportunity to work with innovative technology companies and help them strengthen and scale their security and compliance programs.


• Professional development and career growth through exposure to diverse clients, industries, and regulatory frameworks.


• Pacific Time (PT) working schedule.