Sr. Consultant - Strategy & Risk | Remote, USA

Optiv; Memphis (TN); Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Work/life balance

Professional training resources

Volunteer opportunities

Job summary

Optiv is seeking a Sr. Consultant – Strategy & Risk for a fully remote role in the continental U.S. You will lead strategic cybersecurity advisory engagements, assess risks, and help clients improve security posture while aligning with NIST/ISO frameworks.

Strong communication, governance, and cross-functional collaboration are essential. You will design mature enterprise cybersecurity and GRC programs, develop roadmaps, and drive multi-year transformation initiatives.

Qualifications

• Bachelor's degree and 5-7 years of related work experience, preferably in a consultancy
• Experience leading cybersecurity strategy and transformation engagements, incl. current-state assessments, target-state capability design, operating models, roadmaps, and executive recommendations
• Experience designing, implementing, or maturing enterprise cybersecurity and GRC programs (governance, risk, controls, policy, metrics)
• Experience assessing or developing insider risk programs (governance, identity risks, data protection, monitoring, response)
• Experience developing cyber asset intelligence, asset management or attack surface management capabilities
• Strong ability to translate risk findings into defensible business recommendations and roadmaps
• Experience supporting AI governance, AI risk assessments, and third-party risk assessments

Responsibilities

• Lead strategic cybersecurity advisory engagements and define multi-year roadmaps
• Advise on design, maturity and governance of cybersecurity and GRC programs
• Develop insider risk governance, monitoring and cross-functional operating models
• Create cyber asset intelligence and attack surface management programs
• Translate security risks into business implications and executive reporting
• Facilitate workshops and stakeholder interviews with client teams
• Maintain documentation and reporting of security findings and recommendations
• Stay current with cybersecurity, risk management, and regulatory developments

Skills

Cybersecurity strategy

Risk management

Executive advisory

Regulatory compliance

AI governance

GRC frameworks

Client relationship management

Education

Bachelor's degree

Tools

GRC platforms

Job description

Remote

Leawood, Kansas

Philadelphia, Pennsylvania

Hartford, Connecticut

Dallas, Texas

Richmond, Virginia

Austin, Texas

Nashville, Tennessee

St. Louis, Missouri

King of Prussia, Pennsylvania

Oklahoma City, Oklahoma

Charlotte, North Carolina

Houston, Texas

Memphis, Tennessee

Jacksonville, Florida

Herndon, Virginia

Omaha, Nebraska

Charleston, South Carolina

Detroit, Michigan

Portland, Maine

Raleigh, North Carolina

Louisville, Kentucky

Des Moines, Iowa

Indianapolis, Indiana

Atlanta, Georgia

Tampa, Florida

Grand Rapids, Michigan

Fayetteville, Arkansas

Phoenix, Arizona

Orlando, Florida

Full time

2026-14035

This position will be fully remote and can be hired anywhere in the continental U.S.

Optiv’s consultants are skilled technical and consultative resources expected to be strong in both technical and soft skills. The Sr. Consultant – Strategy & Risk, plays a key role in delivering security solutions, conducting risk and compliance assessments and supports client engagements. This position requires a balance of technical skills, strong risk management knowledge, and client facing consulting experience to help organizations improve their security posture and achieve compliance.

How you’ll make an impact

• Support clients in assessing risks associated with artificial intelligence, including generative AI and third‑party AI solutions, and develop actionable governance and risk mitigation recommendations.
• Assist clients in developing AI governance policies, acceptable‑use standards, oversight processes, and controls aligned with their business objectives and risk management programs.
• Help clients strengthen governance, risk, and compliance (GRC) processes, including risk registers, control mapping, evidence collection, issue management, and remediation tracking.
• Lead strategic cybersecurity advisory engagements to assess current‑state capabilities, define target‑state operating models, and develop multi‑year cybersecurity and GRC strategies, transformation roadmaps, and prioritized investment plans aligned with business risk and frameworks such as NIST CSF, NIST 800‑53, and ISO 27001
• Advise clients on the design, development, and maturity of enterprise cybersecurity and GRC programs, including governance structures, risk frameworks, control environments, policies and standards, metrics, executive reporting, and program operating models.
• Design and mature insider risk programs by establishing governance, risk scenarios, monitoring and response processes, and cross‑functional operating models that integrate cybersecurity, identity, data protection, HR, Legal, Privacy, and Compliance stakeholders.
• Assess and develop cyber asset intelligence and attack surface management programs that improve visibility into enterprise technology assets, ownership, criticality, vulnerabilities, exposures, and risk across traditional IT, cloud, SaaS, and other technology environments.
• Develop executive‑level cybersecurity strategies and business cases that translate cyber risk, control gaps, regulatory requirements, and emerging threats into prioritized initiatives, measurable outcomes, investment decisions, and actionable transformation roadmaps.
• Comfortable delivering independent work or takes the engagement lead for complex projects
• Acts as engagement escalation point to assist other delivery team consultants
• Work closely with clients to define, build and implement security leading practices
• Conduct risk assessments, security readiness audits, gap analysis with compliance and regulatory frameworks
• Assess compliance with industry standards and regulatory frameworks, such as, NIST 800‑171/53, ISO 27001, COSO, CMMC, HIPAA, PCI, or some combination of these
• Assist clients in developing risk management frameworks and mitigation strategies
• Provide third‑party risk assessments to evaluate client’s supply chain, key vendors
• Support the design and implementation of cybersecurity policies, procedures, and governance frameworks
• Develop and refine security strategy assessments, security program plans, and POA&M
• Translate security operational and technical risks into business implications with recommendations for stakeholders
• Conduct workshops, stakeholder interviews, security awareness sessions and presentations with key client stakeholders
• Collaborate with Principal Consultants and Technical Managers to support client objectives
• Maintain clear documentation and reporting for security findings, analysis and recommendations
• Stay updated on emerging cybersecurity, risk management, key technologies and regulations
• Contribute to thought leadership through research, whitepapers and presentations
• Effectively provide knowledge transfer and post‑production support activities as necessary

What we’re looking fo r

• Bachelor's degree and approximately 5-7 years of related work experience, preferably in a prior consultancy role
• Experience leading cybersecurity strategy and transformation engagements, including current‑state assessments, target‑state capability design, cybersecurity operating models, strategic roadmaps, investment prioritization, and executive‑level recommendations.
• Experience designing, implementing, or maturing enterprise cybersecurity and GRC programs across governance, risk management, controls, regulatory compliance, policy management, risk reporting, and cybersecurity metrics.
• Experience assessing or developing insider risk programs, including insider threat scenarios, governance, identity and access risks, data protection, behavioral or activity monitoring considerations, investigation and response processes, and cross‑functional stakeholder engagement.
• Experience developing cyber asset intelligence, asset management, or attack surface management capabilities, including asset discovery, ownership, classification, criticality, vulnerability and exposure management, and integration of asset intelligence into cybersecurity risk decisions.
• Demonstrated ability to advise senior executives and cybersecurity leaders, facilitate strategic workshops, translate complex technical and regulatory issues into business risk, and develop defensible recommendations, operating models, and multi‑year transformation roadmaps.
• Experience supporting AI governance, AI risk assessments, or the evaluation of security, privacy, and third‑party risks associated with enterprise AI adoption.
• Experience translating GRC assessment findings into prioritized remediation roadmaps, governance documentation, and business‑focused recommendations.
• Familiarity with GRC platforms and tools used to manage risks, controls, compliance evidence, and reporting; hands‑on experience preferred.
• Hold or pursue relevant certifications in the cybersecurity and risk management industry such as, CISSP, CISM, CRISC, CCSP, CMMC CCP/CCA, ISO 27001 (Lead implementer)
• Strong understanding of cybersecurity frameworks (NIST, ISO 27001, CMMC, CIS, PCI, HIPAA, etc.)
• Hands‑on experience with security assessments, risk management, compliance assessments, policy and standards and other related risk and compliance activities
• Experience working in cyber resilience including, Business Continuity Planning, Disaster Recovery, Business Impact Analysis, and Operational Resilience.
• Strong analytical and problem‑solving skills for cybersecurity challenges
• Excellent communication and report writing skills for client engagements
• Ability to manage multiple projects and work independently in a fast‑paced environment
• Willingness to travel to meet client needs
• Valid driver's license in the US
• The successful candidate must hold related professional certifications such as the CISSP, CISM, and/or CISA

#LI-SM1

#LI-Remote

What you can expect from Optiv

• A company committed to our inclusive value through our Employee Resource Groups (https://www.optiv.com/company/impact-report/inclusion-and-belonging)
• Work/life balance
• Professional training resources
• Creative problem-solving and the ability to tackle unique, complex projects
• Volunteer Opportunities. “Optiv Chips In” encourages employees to volunteer and engage with their teams and communities.
• The ability and technology necessary to productively work remotely/from home (where applicable)

EEO Statement

Optiv is an equal opportunity employer. All qualified applicants for employment will be considered without regard to race, color, religion, sex, gender identity or expression, sexual orientation, pregnancy, age 40 and over, marital status, genetic information, national origin, status as an individual with a disability, military or veteran status, or any other basis protected by federal, state, or local law.

Optiv respects your privacy. By providing your information through this page or applying for a job at Optiv, you acknowledge that Optiv will collect, use, and process your information, which may include personal information and sensitive personal information, in connection with Optiv’s selection and recruitment activities. For additional details on how Optiv uses and protects your personal information in the application process, click here to view our Applicant Privacy Notice (http://www.optiv.com/job-applicant-privacy-notice) . If you sign up to receive notifications of job postings, you may unsubscribe at any time.

We work alongside clients to manage cyber risk and equip them with perspectives and programs to accelerate business progress.

Our real‑world experience, deep vertical expertise and diverse teams enable us to face any challenge with confidence. We put you at the center of our unmatched ecosystem of people, products, partners and programs to design and implement agile solutions. Our adaptive approach continually assesses risk in the context of cyber and broader objectives to secure today's business and fortify it for the future.

At Optiv, we manage cyber risk so you can secure your full potential.