Architect – GRC/AI Governance

This is a fully remote position, open to applicants in Texas.

📋 Description

• Lead and manage GRC engagements from start to finish, encompassing kickoff, stakeholder interviews, documentation and evidence review, analysis, deliverable creation, and executive presentations.

• Conduct security program maturity assessments in accordance with NIST CSF 2.0, NIST SP 800-53, ISO 27001, and CIS Critical Security Controls.

• Perform gap and readiness evaluations for compliance with PCI DSS, HIPAA, SOC 2, GLBA, FFIEC, SOX, CMMC, and GDPR.

• Execute IT and cyber risk assessments, which include risk identification, analysis, and rating, as well as the development of risk registers and treatment plans.

• Carry out Business Impact Analyses to pinpoint critical processes, dependencies, supporting technologies, and recovery objectives.

• Evaluate and assist in establishing AI governance programs, which encompass AI use-case inventories, acceptable use policies, AI risk assessments, and alignment with frameworks such as NIST AI RMF, ISO/IEC 42001, and the EU AI Act.

• Facilitate client workshops and conduct interviews with executive stakeholders, process owners, and technical teams.

• Assess current capabilities and define target states, priorities, dependencies, and implementation roadmaps.

• Convert regulatory, security, and AI requirements into customized controls, governance models, policies, procedures, standards, and measurable objectives.

• Create and review assessment reports, gap analyses, maturity scorecards, risk registers, control mappings, BIA reports, executive briefings, and strategic roadmaps for quality.

• Oversee engagement schedules, status updates, client communications, and the escalation of potential scope or timeline risks.

• Mentor consultants and provide technical quality assessments of their work.

• Contribute to the development of delivery methodologies, assessment tools, templates, and reusable intellectual property.

• Stay updated on evolving frameworks, regulations, and industry trends, sharing insights and lessons learned.

⛳️ Requirements

• Bachelor’s degree in Information Systems, Cybersecurity, or a related field, or equivalent professional experience.

• At least 8 years of experience in information security, IT risk, or IT audit, with a minimum of 5 years in delivering GRC consulting or assessment engagements.

• Proven experience leading NIST CSF assessments, from planning and stakeholder interviews through maturity scoring, roadmap creation, and executive presentations.

• Strong expertise in assessing the maturity of security programs to identify current states and establish roadmaps to defined target states that consider capability gaps and associated risks.

• Extensive knowledge of industry security and risk management frameworks, including NIST CSF, NIST SP 800-53, ISO 27001, ISO 27005, and NIST RMF, alongside practical experience assessing according to these standards.

• Experience conducting IT/IS risk, privacy, and control assessments based on leading practices and regulatory requirements, including PCI DSS, SOC 2, HIPAA, and GDPR.

• Exceptional written communication skills with the ability to produce clear, client-ready deliverables.

• Strong oral communication and presentation skills, capable of conveying findings to C-level executives and non-technical audiences.

• Highly organized, detail-oriented, with excellent time management skills, able to prioritize effectively in a fast-paced, high-volume, and dynamic work environment.

• Ability to manage multiple concurrent engagements and shifting priorities while meeting deadlines.

• Proactive and consultative approach to client requests; able to listen, understand client needs, and deliver effectively.

• Self-motivated individual who enjoys solving complex problems and is comfortable working directly with clients.

• Willingness to travel as needed.

• CISSP, CISA, CISM, CRISC, or equivalent security or risk certification is highly desirable.

• Experience with Business Impact Analyses and supporting business continuity and disaster recovery programs is preferred.

• Familiarity with AI governance frameworks and regulations is preferred.

• Relevant certifications such as CBCP, ISO 27001 Lead Auditor or Lead Implementer, ISO/IEC 42001 Lead Implementer or Lead Auditor, IAPP AIGP, or CIPP are preferred.

• Experience with GRC platforms such as ServiceNow IRM, Archer, or OneTrust is preferred.

• Experience serving clients in regulated industries is preferred.

• Previous experience in professional services or Big 4 consulting is preferred.

🏝️ Benefits

• Comprehensive medical, dental, and vision plans for you and your dependents.

• 401(k) Retirement Plan with Employer Match.

• 529 College Savings Plan.

• Health Savings Account.

• Life Insurance.

• Long-Term Disability.

• Competitive Compensation.

• Training and development programs.

• Major offices stocked with snacks and beverages.

• Collaborative and vibrant culture.

• Work-life balance and generous paid time off.