Cybersecurity GRC Consultant
SISA Information Security Pvt · Mumbai · onsite · Posted 35d ago
Undisclosed5–10 yrsfulltimeSourced from
About a minute. You'll make an account on the way through.
About this role
The role requires practical experience in control assessment, framework mapping, evidence validation, gap assessment, risk analysis, remediation advisory and audit/report delivery. The ideal candidate should be comfortable working directly with clients, understanding their technology and business environment, translating requirements into actionable controls, and managing engagements from scoping through final deliverables.
This is a delivery-focused consulting role requiring both technical understanding and strong client-facing capabilities.
Key Responsibilities - Lead end-to-end cybersecurity GRC and compliance engagements, including scoping, planning, assessment, evidence review, gap analysis, remediation support and final reporting.
- Perform assessments against CMMC 2.0, FedRAMP, NIST SP 800-171, NIST SP 800-53, ISO 27001, SOC 2 and HITRUST CSF, based on client requirements.
- Develop and maintain control mappings and crosswalks across CMMC, FedRAMP, NIST, ISO 27001, SOC 2 and HITRUST.
- Conduct detailed control design and operating effectiveness assessments, including review of policies, procedures, configurations, records and other audit evidence.
- Evaluate control gaps, determine risk and impact, and develop practical remediation recommendations.
- Support clients in defining and documenting security controls, policies, procedures, control narratives and evidence requirements.
- Develop and/or review System Security Plans (SSPs), Plans of Action Milestones (POAMs), risk assessments, Statements of Applicability, control matrices and audit workpapers.
- Support SOC 2 readiness and Type I/Type II assessment activities, including Trust Services Criteria mapping, control testing and evidence evaluation.
- Support ISO 27001 implementation / readiness / certification and surveillance activities, including ISMS controls, risk treatment and Statement of Applicability.
- Support HITRUST CSF readiness and validated assessment activities, including control mapping, evidence assessment and remediation tracking.
- Perform NIST-based cybersecurity assessments using NIST CSF and NIST SP 800-series standards where applicable.
- Validate control mappings and assessment methodologies against applicable regulatory, industry and framework requirements.
- Lead client discussions with IT, security, engineering, compliance, risk and audit stakeholders to understand the environment and validate controls.
- Prepare assessment reports, findings, risk ratings, executive summaries and remediation roadmaps for technical and executive audiences.
- Coordinate with external assessors, auditors, C3PAOs/3PAOs and other assurance stakeholders where applicable.
- Maintain assessment quality through structured workpapers, evidence traceability, review procedures and quality assurance.
- Contribute to development and continuous improvement of GRC methodologies, assessment templates, control libraries and reusable delivery assets.
- Support presales activities, including scope definition, effort estimation, solutioning and technical proposal inputs.
- 5+ years of hands-on experience in cybersecurity GRC, IT audit, security compliance or risk consulting.
- Demonstrated experience delivering one or more of the following:
- CMMC 2.0
- FedRAMP
- NIST CSF / NIST SP 800-171 / NIST SP 800-53
- ISO 27001
- SOC 2
- HITRUST CSF
- Strong understanding of security control frameworks, control objectives, control design, operating effectiveness and evidence-based assessment methodologies.
- Hands-on experience with control mapping/crosswalks across multiple cybersecurity and compliance frameworks.
- Experience conducting gap assessments, risk assessments, control testing and evidence validation.
- Experience preparing or reviewing SSPs, POAMs, risk registers, control matrices, audit workpapers and assessment reports.
- Practical understanding of cloud security, IAM, network security, vulnerability management, logging/monitoring, incident response, data protection, business continuity and third-party risk.
- Ability to translate technical and regulatory requirements into practical security controls and implementation recommendations.
- Strong written and verbal communication skills with the ability to communicate effectively with both technical teams and senior management.
- Ability to work independently in a consulting environment and manage multiple client engagements.
Certifications in one or more of the following are preferred:
- CMMC-AB Certified CMMC Professional (CCP) / Certified CMMC Assessor (CCA)
- FedRAMP / 3PAO assessment experience
- CISSP
- CISA
- CISM
- CRISC
- ISO 27001 Lead Auditor / Lead Implementer
- HITRUST Certified CSF Practitioner / related HITRUST credential
- SOC 2 / AICPA-related audit or assurance experience
Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.
Sourced from naukri
Skills
SOCCismManager Quality Assurancegap analysisCisaIso 27001MonitoringISMSNetwork SecurityIT Audit
About SISA Information Security
SISA Information Security Pvt
IT Services & Consulting
400
employees
2003
23 years old
Bengaluru, Karnataka
India
₹9.2L PA avg
Avg at SISA Information Security
About
SISA;s Forensics-driven Cybersecurity Framework equips you with right tools and expertise to improve security posture, business growth with optimized cost.
Industries
IT Services & Consulting
Employee ratings
10 reviews
3.0/ 5
Culture
3.0
Career growth
2.3
Work-life
2.7
Employees rate it well for
Job Security31Skill Development30
Find them on