Senior Consultant – Strategy & Risk

This is a fully remote position, open to applicants in Arizona, +16 more locations.

📋 Description

• Assist clients in evaluating the risks linked to artificial intelligence while formulating governance and risk mitigation strategies.

• Collaborate with clients to establish AI governance policies, acceptable-use standards, oversight frameworks, and controls.

• Enhance governance, risk, and compliance workflows, including risk registers, control mapping, evidence gathering, issue tracking, and remediation processes.

• Spearhead strategic cybersecurity advisory projects, creating cybersecurity and GRC strategies, transformation roadmaps, and investment plans.

• Provide expert advice to clients regarding enterprise cybersecurity and GRC initiatives, governance models, risk frameworks, controls, policies, metrics, and executive reporting.

• Design and advance insider risk programs by engaging cybersecurity, identity, data protection, HR, Legal, Privacy, and Compliance stakeholders.

• Evaluate and develop cyber asset intelligence as well as attack surface management programs.

• Formulate executive-level cybersecurity strategies and business cases.

• Oversee intricate projects and serve as an escalation point for engagement issues.

• Perform risk assessments, security readiness evaluations, and gap analyses.

• Evaluate compliance with industry standards and regulatory guidelines.

• Create risk management frameworks, mitigation plans, security program strategies, and Plans of Action and Milestones (POA&Ms).

• Execute third-party risk evaluations of supply chains and critical vendors.

• Facilitate workshops, stakeholder interviews, security awareness sessions, and presentations.

• Maintain comprehensive documentation and reporting of security findings and recommendations.

• Keep abreast of emerging trends in cybersecurity, risk management, technologies, and regulations.

• Contribute to thought leadership through research, whitepapers, and presentations.

• Offer knowledge transfer and post-production support.

⛳️ Requirements

• Bachelor's degree with approximately 5-7 years of relevant experience, ideally in a consultancy environment.

• Proven experience leading cybersecurity strategy and transformation initiatives.

• Background in designing, implementing, or enhancing enterprise cybersecurity and GRC programs.

• Experience in assessing or developing insider risk frameworks.

• Proficiency in developing cyber asset intelligence, asset management, or attack surface management capabilities.

• Ability to counsel senior executives and cybersecurity leaders while facilitating strategic workshops.

• Experience in supporting AI governance, conducting AI risk assessments, or evaluating enterprise AI risks.

• Skill in translating GRC assessment results into actionable remediation roadmaps and recommendations.

• Familiarity with GRC platforms and tools; hands-on experience is preferred.

• Possess or be pursuing relevant certifications such as CISSP, CISM, CRISC, CCSP, CMMC CCP/CCA, or ISO 27001 Lead Implementer.

• Strong knowledge of cybersecurity frameworks including NIST, ISO 27001, CMMC, CIS, PCI, and HIPAA.

• Hands-on experience with security assessments, risk management, compliance evaluations, policies, and standards.

• Experience with cyber resilience, Business Continuity Planning, Disaster Recovery, Business Impact Analysis, and Operational Resilience.

• Excellent analytical and problem-solving abilities.

• Strong communication and report writing skills.

• Capacity to manage multiple projects and work independently.

• Willingness to travel to address client needs.

• Valid driver's license in the US.

• Must possess relevant professional certifications such as CISSP, CISM, and/or CISA.

🏝️ Benefits

• Work/life balance.

• Access to professional training resources.

• Opportunities for creative problem-solving and engagement in unique, complex projects.

• Volunteer opportunities through “Optiv Chips In.”

• The ability and technology needed to effectively work remotely/from home (where applicable).

• Inclusive Employee Resource Groups.