Senior Information Security Analyst

ConsultNet Technology Services and Solutions; United States; Remote; USD 103,000 - 117,000; Part time

Job summary

ConsultNet Technology Services and Solutions is seeking a Senior Cyber Risk & Compliance Analyst to strengthen cybersecurity governance, risk management, and compliance across the enterprise. This senior IC will combine deep GRC expertise with practical knowledge of infrastructure, applications, identity, cloud, and business processes.

You will translate vulnerabilities, audit findings, and regulatory requirements into defensible risk decisions, remediation roadmaps, and executive reporting,

Qualifications

• Bachelor's degree in cybersecurity, IT, CS, MIS or related field.
• 8+ years of progressive IT/cybersecurity, audit, risk, or compliance experience with hands-on technical responsibility.
• Progression from technical IT/security into governance, risk, compliance, audit, or leadership.
• Experience with ISO/IEC 27001 and NIST-based frameworks.
• Experience supporting internal/external IT/cybersecurity audits and evaluating control design/operating effectiveness including SOX ITGC.
• Experience managing vulnerability or penetration-testing findings through remediation.

Responsibilities

• Lead cybersecurity risk assessments, maintain risk registers, and manage risk treatment plans and closure evidence.
• Administer and mature Drata or a comparable GRC platform, including controls, evidence, testing, ownership, workflows, and integrations.
• Support readiness and gap assessments across ISO/IEC 27001, TISAX, NIST CSF, and SOX ITGC and develop remediation roadmaps.
• Coordinate internal and external IT/cybersecurity audits and drive remediation.
• Coordinate penetration testing and remediation, validating severity and business impact.
• Develop and maintain cybersecurity policies, standards, procedures, control requirements, and framework mappings.
• Assess identity and access controls, provisioning/deprovisioning, change management, logging, monitoring, and recovery controls.
• Partner with infrastructure, cloud, and vendor teams to address high-risk findings and improve security posture.
• Perform cybersecurity reviews of technology providers and support third-party risk and resilience programs.
• Develop risk indicators, dashboards, and executive governance materials.

Skills

GRC governance

ISO/IEC 27001

NIST CSF

SOX ITGC

Vulnerability management

Drata

Third‑party risk

Identity governance

Executive reporting

Cross‑functional collaboration

Education

Bachelor's degree in cybersecurity / IT related field

Tools

Drata or other GRC platforms

Job description

Title: Senior Cyber Risk & Compliance Analyst

Location : Remote

Target Start Date : ASAP (must be readily available, looking to start week of 11/2)

Type: Contract

Pay Rate : $75.00-$85.00/hr

Summary

Our client is seeking a Senior Cyber Risk & Compliance Analyst to strengthen cybersecurity governance, risk management, compliance, audit readiness, and technical assurance across the enterprise. This senior individual contributor will combine strong GRC expertise with practical technical knowledge across infrastructure, applications, identity, cloud, and business processes.

The role will translate technical vulnerabilities, control deficiencies, audit findings, and regulatory requirements into defensible risk decisions, prioritized remediation plans, measurable outcomes, and clear executive reporting. Key areas include Drata, ISO/IEC 27001, TISAX, NIST Cybersecurity Framework, SOX IT General Controls, vulnerability management, third-party risk, identity governance, and operational resilience.

Key Requirements

• Lead cybersecurity risk assessments, maintain risk registers, and manage risk treatment plans, exceptions, corrective actions, and closure evidence.
• Administer and mature Drata or a comparable GRC platform, including controls, frameworks, evidence, testing, ownership, workflows, and integrations.
• Support readiness and gap assessments across ISO/IEC 27001, TISAX, NIST CSF, and SOX ITGC requirements and develop practical remediation roadmaps.
• Coordinate internal and external IT/cybersecurity audits, evaluate control design and operating effectiveness, and drive findings through remediation and closure.
• Coordinate penetration testing and vulnerability remediation, validating severity, business impact, ownership, compensating controls, and retesting.
• Develop and maintain cybersecurity policies, standards, procedures, control requirements, and framework mappings.
• Assess identity and access controls, privileged access, provisioning/deprovisioning, segregation of duties, change management, logging, monitoring, backup, and recovery controls.
• Partner with infrastructure, application, cloud, engineering, identity, and vendor teams to address high-risk findings and improve security posture.
• Perform cybersecurity reviews of technology providers and support third-party risk, business continuity, disaster recovery, and operational resilience programs.
• Develop risk indicators, dashboards, governance materials, and executive-level reporting.
• Lead cross-functional governance activities and communicate complex technical and regulatory issues to both technical and business stakeholders.

Required Qualifications

• Bachelor's degree in cybersecurity, information technology, computer science, management information systems, or a related field.
• 8+ years of progressive experience across IT, cybersecurity, audit, risk, or compliance, including meaningful hands‑on technical responsibility.
• Demonstrated progression from technical IT or security work into cybersecurity governance, risk, compliance, audit, or security leadership.
• Practical experience with ISO/IEC 27001 and NIST-based cybersecurity frameworks.
• Experience supporting internal and external IT/cybersecurity audits and evaluating control design and operating effectiveness, including SOX ITGC.
• Experience managing vulnerability or penetration-testing findings through remediation, validation, and closure.
• Working knowledge of identity and access management, Windows/Linux infrastructure, network security, enterprise applications, cloud services, logging/monitoring, system hardening, and incident response.
• Experience developing policies, standards, procedures, risk records, audit evidence, and executive reporting.
• Strong cross-functional leadership and communication skills, with the ability to clearly communicate risk to technical and nontechnical audiences.
• Ability to work in the Eastern Time Zone.

Preferred Qualifications

• Master's degree in cybersecurity, information security, IT, or a related discipline.
• ISO/IEC 27001 Lead Implementer, Lead Auditor, CISA, CISM, CRISC, or comparable certification.
• Hands‑on experience implementing, administering, or materially improving Drata or another enterprise GRC platform.
• TISAX or comparable security assurance/certification experience in manufacturing, automotive, engineering, or other complex enterprise environments.
• Experience with security for SAP, SAP IAM, Oracle, or other major ERP/business‑critical application environments.
• Experience with critical infrastructure, OT, IC, SCADA, or manufacturing technology security.
• Experience with business continuity, disaster recovery, business impact analysis, recovery objectives, or operational resilience.
• Experience working in a large, geographically distributed, regulated, manufacturing, or otherwise complex enterprise environment.

Impact

This role will help strengthen the organization's overall cybersecurity posture by connecting technical security issues, business risk, compliance requirements, and executive decision-making. The successful candidate will improve the maturity of GRC processes, increase audit and certification readiness, accelerate remediation of material risks, and establish sustainable controls and governance practices across the enterprise.