Senior Technical Consultant - Security GRC

Responsibilities

• Client consulting and engagement leadership

• Shape problem statements, engagement scope, assumptions, and success criteria with the client sponsor and the account team.

• Build workplans, RAID logs, and stakeholder maps; keep delivery on quality even when the client’s evidence or ownership is incomplete.

• Facilitate workshops with CISOs, control owners, internal audit, legal, procurement, and business executives. Drive decisions, not status meetings.

• Manage resistance, conflicting frameworks, and “we already have a policy” arguments without losing the room or the facts.

• Write and present deliverables that survive legal, audit, and executive review: current-state assessments, target operating models, control crosswalks, risk registers, quantified scenarios, roadmaps, and board narratives.

• Coach client staff so the program does not collapse when the engagement ends. Consulting value is transfer, not slide volume.

• Support pre-sales and scoping when asked: approach, level of effort, risks to delivery, and what “good” looks like for this client.

• Framework design, assessment, and rationalization

• Assess and design against NIST CSF (1.1 and/or 2.0): profiles, subcategory outcomes, tiers, and CSF as the executive reporting spine.

• Assess and tailor NIST SP 800-53 (Rev. 5 preferred): control families, baselines, overlays, common/hybrid/system-specific controls, and assessment procedures.

• Assess NIST SP 800-171 implementation for CUI: requirement status, 800-171A-style objectives, scoping of CUI flows, POA&Ms, and contractor obligation implications.

• Apply CIS Controls (v8 preferred) as a prioritized operational control set (IG1–IG3), mapped to CSF and 800-53 rather than run as a second bureaucracy.

• Interpret and assess the CRI Profile, including diagnostic statements and financial-sector or critical-third-party expectations.

• Design or uplift an ISO/IEC 27001 ISMS: scope, SoA, risk assessment and treatment, internal audit liaison, management review inputs, and certification or surveillance readiness.

• Build and maintain crosswalks so one control, one owner, and one evidence package can satisfy multiple frameworks

• Assurance, evidence, and defensible writing

• Design test procedures, challenge evidence quality, and write deficiency and residual-risk narratives that are factual and unambiguous.

• Prepare clients for internal audit, ISO certification bodies, customer assessments, and 800-171 / CRI / CSF inquiries.

• Produce executive summaries that a non-specialist leader can act on without a decoder.