GRC Consultant

Seeking a GRC and Privacy professional with 3 - 4 years of experience to support and enhance governance, risk, and compliance programs across ISO/IEC 27001 2022 SOC 2 Type II, HIPAA, HITRUST, and ISO/IEC 27701 The role involves audit readiness, risk management, policy governance, and third-party risk oversight across internal programs or client engagements.

The candidate will have responsibilities across the following functions:

Governance and Compliance:

• Lead implementation aligned with SOC 2 Type II audits, ISO/IEC 27001:2022 and PIMS aligned with ISO/IEC 27701 HIPAA and HITRUST.
• Perform control mapping across frameworks to build a unified control framework for RISA Labs.
• Monitor compliance metrics, control effectiveness, and remediation progress through periodic reviews and reporting.
• Maintain compliance exceptions, risk acceptances, and corrective action plans.
• Track changes in applicable security, privacy, and regulatory requirements and assess their impact on organisational controls.
• Develop, review, and update policies, standards, and procedures.

Audit and Assurance:

• Execute SOC 2 Type II audits (control mapping, walkthroughs, evidence collection and validation).
• Lead audit requirements aligned with ISO/IEC 27001:2022 ISO/IEC 27701 HIPAA and HITRUST.
• Coordinate internal/external audits and manage the audit lifecycle.
• Support continuous control monitoring (CCM) and periodic compliance reviews.
• Prepare reports for leadership and lead management review meetings.
• Participate in customer/vendor audits (client-facing audits).

Risk Management:

• Lead enterprise risk assessments, maintain the organisational risk register, evaluate identified risks, recommend mitigation strategies, and track remediation activities to closure.
• Support risk prioritisation using qualitative/quantitative methods.
• Perform control gap assessments and drive remediation tracking.
• Manage risk acceptances, exceptions, and deviations with proper approvals and tracking.

Third-Party Risk Management (TPRM):

• Perform Vendor Risk Assessments for critical/high-risk vendors.
• Manage the third-party risk management lifecycle, including due diligence, security assessments, questionnaire reviews, risk evaluation, onboarding, periodic reassessments, and offboarding.
• Conduct detailed contractual reviews of vendor agreements in collaboration with Legal to ensure inclusion and compliance with security, privacy, and regulatory requirements.

Privacy and Data Protection:

• Govern data lifecycle management, including classification, retention, archival, and deletion.
• Conduct Privacy Impact Assessments (PIA/DPIA).
• Ensure proper handling of PII/PHI data by the teams.
• Support handling of data subject rights requests (DSAR) such as access, deletion, and rectification.

Awareness and Stakeholder Management:

• Conduct security and privacy awareness training programs and track participation.
• Collaborate with IT / Security / Tech / HR / Product / Engineering teams for control implementation and monitoring.
• Collaborate with legal, privacy, and business teams on regulatory and data protection requirements.
• Support privacy incident/data breach assessments and reporting obligations.
• Review customer contracts and lead client questionnaires to ensure alignment with security, compliance, and regulatory requirements.

Requirements:

• Hands-on experience with ISO/IEC 27001 ISO/IEC 27701 SOC 2 Type II audits, HIPAA and HITRUST.
• Strong understanding of conducting risk assessments, maintaining risk registers, and tracking remediation activities across internal operations, client engagements, and vendor ecosystems.
• Experience in audit coordination, evidence management, and audit lifecycle handling.
• Develop, document, maintain, and update the policies, standards, procedures, and supporting documentation.
• Working knowledge of Privacy frameworks (ISO 27701 / HIPAA).
• General understanding of Global Privacy Regulations (e. g., CCPA, General Data Protection Regulation, India DPDP Act).
• Experience in working with GRC tools.
• Ability to work with cross-functional stakeholders (IT, Legal, Business).
• Certifications like ISO/IEC 27001 Lead Implementer / Lead Auditor, ISO 27701 Lead Implementer / Auditor or similar certifications are preferred.