Senior GRC Consultant (Remote, Contractor)

About the role

We are seeking a Senior GRC Consultant to lead audit‑readiness and compliance program development for a fast‑growing U.S. cybersecurity and compliance consulting startup. This long‑term contractor position is fully remote and works within U.S. business hours, offering the chance to shape security programs for innovative technology companies.

Key responsibilities

• Lead compliance readiness engagements for frameworks such as SOC 2 (Type I/II), ISO 27001/27002, HIPAA, GDPR, and U.S. state privacy laws.
• Own and operate GRC platforms (e.g., Vanta, Drata) to maintain continuous evidence collection and monitoring.
• Conduct formal risk assessments using NIST 800‑30 and translate findings into business‑level risks.
• Design and implement end‑to‑end GRC programs, including policies, control frameworks, and risk registers.
• Perform internal audits, evaluate control design and effectiveness, and prepare audit‑ready deliverables.
• Manage vendor security questionnaires and build reusable knowledge bases.
• Engage with client leadership, provide status updates, and ensure expectations are met throughout each engagement.

Required profile

• 5–7+ years of hands‑on experience in GRC, compliance, or information‑security audits.
• Prior consulting or professional‑services experience managing multiple client engagements.
• Proven ability to build compliance programs from the ground up and map controls across frameworks.

Required skills

• SOC 2 (Type I & II)
• ISO 27001 / ISO 27002
• GDPR, CCPA/CPRA, HIPAA
• NIST 800‑30 risk assessment methodology
• Vanta, Drata (or similar GRC platforms)
• Audit readiness and evidence collection

What we offer

• Long‑term contract with a high‑growth cybersecurity startup
• Fully remote work with flexible scheduling
• Direct client exposure and ownership of engagements