Senior GRC Consultant

Jobgether; United States; Remote; USD 140,000 - 180,000; Full time

Benefits offered by this job

100% remote work

Autonomy and ownership

Exposure to top clients

Professional development

Job summary

Jobgether, on behalf of our partner, is seeking a Senior GRC Consultant based in the United States. You will own security, governance, risk, and compliance initiatives across technology-focused client engagements, leading programs from scoping to audits and remediation.

You will work with executives, technical teams, and external auditors to translate complex security requirements into practical solutions, manage multiple engagements, and help clients strengthen their security posture and scale

Qualifications

• 5–7+ years in GRC, regulatory compliance, or security auditing.
• Experience in consulting or professional services.
• Expertise with SOC 2 Type I/II and ISO 27001/27002.
• Experience with GDPR, CCPA/CPRA, or HIPAA.
• Ability to map controls across frameworks.
• Strong cloud security, IAM, CI/CD, and security controls.
• Experience using Vanta or Drata.

Responsibilities

• Lead end-to-end compliance readiness and implementation across multiple engagements.
• Manage GRC platforms and evidence collection.
• Conduct risk assessments using NIST 800-30.
• Design and maintain GRC programs including policies and controls.
• Coordinate with auditors and support audit lifecycle.
• Develop client deliverables like risk registers and control matrices.
• Build relationships with client executives and stakeholders.

Skills

GRC expertise

SOC 2 Type I/II

ISO 27001

NIST 800-30

Cloud security

IAM

Auditing

Stakeholder mgmt

Tools

Vanta

Drata

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior GRC Consultant based in United States.

As a Senior GRC Consultant, you will take ownership of security, governance, risk, and compliance initiatives across multiple technology-focused client engagements. You will lead compliance programs from initial scoping and readiness assessments through remediation and external audits, ensuring organizations meet key regulatory and security standards. Working closely with executive stakeholders, technical teams, and external auditors, you will translate complex security requirements into practical business solutions. You will manage multiple engagements independently while helping innovative companies strengthen their security posture and scale their compliance operations. This is an opportunity to join a growing, highly technical consulting environment where autonomy, client relationships, and meaningful ownership are central to the role. You will also have the opportunity to shape and implement scalable GRC practices while contributing to the maturity of modern cybersecurity programs.

Accountabilities

• Lead end-to-end compliance readiness and implementation engagements covering SOC 2 Type I and II, ISO 27001, HIPAA, U.S. state privacy regulations, and UK/EU GDPR.
• Manage and optimize GRC platforms such as Vanta, Drata, and similar tools, ensuring continuous compliance monitoring and accurate evidence collection.
• Conduct formal risk assessments using methodologies such as NIST 800-30, translating technical vulnerabilities and findings into actionable business and compliance risks.
• Design, implement, and maintain comprehensive GRC programs, including security policies, control frameworks, risk management processes, and evidence management procedures.
• Perform internal audits and assess control design and operational effectiveness, identifying gaps and recommending appropriate remediation measures.
• Coordinate vendor security assessments and questionnaires, collaborating with internal subject matter experts and developing reusable knowledge bases.
• Build and maintain strong relationships with client executives and stakeholders, leading recurring meetings, communicating progress, and managing expectations throughout each engagement.
• Prepare high-quality client deliverables, including policies, procedures, risk registers, control matrices, evidence packages, and assessment reports.
• Coordinate with external auditors and support clients throughout the audit lifecycle, ensuring timely delivery of documentation and successful completion of assessments.

Requirements

• 5–7+ years of hands-on experience in Governance, Risk, and Compliance (GRC), regulatory compliance, or information security auditing.
• Previous experience in consulting or professional services, with the ability to independently manage multiple client engagements simultaneously.
• Strong practical expertise in SOC 2 Type I and II and ISO 27001/ISO 27002 frameworks, including implementation, control mapping, and audit readiness.
• Experience working with additional regulatory or compliance frameworks, such as GDPR, CCPA/CPRA, or HIPAA.
• Proven ability to develop and implement compliance programs from the ground up and map controls across multiple frameworks.
• Solid technical understanding of cloud security, identity and access management (IAM), CI/CD pipelines, and security controls.
• Hands‑on experience with GRC platforms such as Vanta, Drata, or equivalent solutions.
• Excellent documentation, analytical, and technical writing skills, with the ability to produce clear and comprehensive compliance deliverables.
• Strong communication and stakeholder management skills, with professional-level English and confidence leading meetings with U.S.-based clients.
• Ability to work independently, prioritize competing deadlines, and demonstrate ownership across multiple client engagements.

Nice To Have

• Experience working directly with external auditors throughout certification and compliance assessments.
• Hands‑on experience implementing GDPR or U.S. privacy compliance programs.
• Familiarity with ISO 42001 (AI Management Systems).
• Relevant professional certifications, such as CISA, CISM, CRISC, ISO 27001 Lead Auditor, ISO 27001 Lead Implementer, or equivalent qualifications.

Benefits

• Long-term independent contractor opportunity with a full-time workload.
• 100% remote work arrangement, offering flexibility to work from anywhere in United States.
• Opportunity to join an early-stage, fast-growing cybersecurity and compliance consulting environment.
• Direct exposure to founders, executive stakeholders, and client leadership teams.
• Significant autonomy and ownership over high-impact client engagements from start to finish.
• Opportunity to work with innovative technology companies and help them strengthen and scale their security and compliance programs.
• Professional development and career growth through exposure to diverse clients, industries, and regulatory frameworks.
• Pacific Time (PT) working schedule.

Data Privacy Notice

By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.