Cybersecurity Governance, Risk, and Compliance (GRC) consultant

The Cybersecurity Governance Risk and Compliance Offshore Consultant will support Client Cyber GRC program across IT risk management third-party risk reviews audit readiness business continuity and disaster recovery governance access review support and cybersecurity maturity initiatives. This role requires strong GRC experience disciplined follow-through clear communication and the ability to coordinate effectively with stakeholders technology teams vendors and enterprise risk partners.

Maintain the IT risk register including risk identification documentation ownership treatment plans acceptance decisions and status reporting.

• Work with risk owners to drive mitigation closure or formal acceptance of identified risks within agreed timelines.
• Support cybersecurity risk assessments including artificial intelligence cloud services and other emerging technology areas.
• Prepare recurring cybersecurity risk metrics dashboards and leadership updates.
• Perform vendor security reviews including assessment of SOC reports security questionnaires control gaps and remediation plans.
• Support business continuity and disaster recovery governance by tracking DR test completeness runbook validation readiness metrics and open gaps.
• Manage Cyber GRC operational requests and ServiceNow tickets in alignment with response escalation documentation and closure expectations.
• Support user access review expansion by assisting with application onboarding entitlement data collection access model preparation stakeholder coordination and modification tracking.
• Support audit readiness by coordinating evidence collection analyzing prior audit requests tracking deliverables and preparing audit evidence packages.
• Contribute to cybersecurity maturity improvement initiatives aligned to NIST-based benchmark and roadmap activities including MFA account lifecycle segregation of duties file integrity monitoring disaster recovery encryption patch governance CMDB maturity and standards updates.

• Maintain accurate and current risk records including ownership treatment approach due dates supporting documentation and status.
• Drive timely closure or formal acceptance of high-moderate and moderate risks including justification for overdue items.
• Complete assigned major risk assessments within agreed timeframes
• Respond to new vendor security review requests within five business days after receipt of required evidence.
• Complete recurring Tier 1 and Tier 2 vendor reviews with an expected average of five reviews per month subject to review complexity and annual schedules.
• Submit weekly GRC status reports covering action items blockers key risk updates vendor review progress BC/DR metrics audit readiness and access review activity.
• Support onboarding of two to five additional applications per month into the user access review process where dependencies and readiness allow.
• Contribute to cybersecurity maturity uplift activities by providing clear status dependencies risks and completion evidence.

• Three or more years of experience in cybersecurity governance risk management compliance IT audit third-party risk management or a related information security role.
• Working knowledge of cybersecurity risk management control assessment risk treatment issue tracking and metrics reporting practices.
• Experience reviewing vendor security documentation including SOC reports security questionnaires control narratives and remediation plans.
• Familiarity with cybersecurity frameworks and regulatory expectations such as NIST Cybersecurity Framework NIST 800-53 ISO 27001 PCI DSS GLBA ITGC SOC reporting and privacy or financial services compliance requirements.
• Experience supporting audits evidence collection control validation and audit readiness activities.
• Strong documentation analytical follow-up stakeholder coordination and professional communication skills.
• Ability to work independently in an offshore delivery model while maintaining timely escalation and accurate reporting.
• Proficiency with Microsoft Office and collaboration tools for tracking reporting presentations and stakeholder communication.

• Experience with GRC workflow or identity governance platforms such as Quantivate ServiceNow Saviynt or equivalent tools.
• Experience supporting business continuity disaster recovery vulnerability management patch governance CMDB improvement or cybersecurity maturity programs.
• Relevant certifications such as CISA CRISC CISSP CISM Security ISO 27001 Lead Implementer or similar credentials.
• Prior experience supporting financial services credit union banking or other regulated environments.

• Operate as part of an offshore Cyber GRC support model with regular coordination across stakeholders and internal technology teams.
• Provide timely updates and escalate risks blockers dependencies and overdue items.
• Handle sensitive security vendor audit risk and access review information with appropriate confidentiality.
• Demonstrate ownership of assigned deliverables from intake through closure.

Required Experience:

Manager