Principal/Senior Consultant, Governance, Risk & Compliance

Principal/Senior Consultant, Governance, Risk & Compliance  Practice: Cybersecurity, Governance, Risk & Compliance Employment Type: Full-Time Location: Remote, United States Travel: Occasional travel to client locations for assessments, workshops, interviews, and other project activities  Position Summary  Pellera Technologies is seeking an experienced Principal / Senior GRC Consultant, to join our growing Cybersecurity Services practice. This is an opportunity for a seasoned cybersecurity, audit, risk, and compliance professional to advise a diverse portfolio of clients, lead complex consulting engagements, and help organizations turn regulatory and security requirements into practical, sustainable improvements.  The Principal/Senior Consultant will lead and contribute to cybersecurity audits, risk and framework assessments, compliance-readiness programs, cloud-security reviews, governance initiatives, and strategic advisory engagements. The role calls for someone who can move comfortably between executive conversations, stakeholder interviews, evidence analysis, control testing, technical discussions, and the production of high-quality client deliverables.  Our consultants are not limited to producing findings. They help clients understand risk, prioritize action, strengthen controls, prepare for high-stake audits and assessments, and build governance programs that support long-term business objectives. Pellera’s established methodology incorporates interviews, evidence gathering, observations, risk and gap analysis, prioritized recommendations, and executive-ready reporting.   What You Will Do  Lead Cybersecurity and GRC Consulting Engagements  Lead complex client engagements from discovery and planning through assessment, reporting, and executive presentation.  Conduct stakeholder interviews with executives, technology leaders, system owners, control owners, legal and compliance personnel, business leaders, and other subject matter experts.  Review policies, standards, procedures, system documentation, architecture diagrams, data flows, prior assessments, audit reports, control evidence, technical configurations, and other relevant artifacts.  Evaluate the design, implementation, and operating effectiveness of cybersecurity, privacy, resiliency, and technology controls.  Identify control gaps, risks, exceptions, dependencies, and opportunities for improvement.  Develop pragmatic, risk-based recommendations, remediation roadmaps, plans of action and milestones, maturity models, and prioritized implementation plans.  Produce polished assessment reports, control workpapers, executive summaries, presentations, dashboards, and other audit-defensible deliverables.  Present results to technical teams, executives, boards, auditors, assessors, and other client stakeholders.  Pellera GRC engagements commonly include structured interviews, documentation and evidence review, control analysis, risk prioritization, and reporting. Depending on the project, Consultants may also perform technical control observations or configuration reviews.   Deliver Framework, Regulatory, and Audit Services  Lead or support advisory, readiness, assessment, audit, and remediation services involving frameworks and requirements such as:  PCI DSS, including scoping, readiness assessments, SAQ support, Reports on Compliance, Attestations of Compliance, remediation guidance, and ongoing compliance advisory  CMMC and NIST SP 800-171, including readiness assessments, evidence validation, CUI boundary and data-flow analysis, SPRS and POA&M support, remediation roadmaps, mock assessments, and preparation for authorized C3PAO assessments  HIPAA Security, Privacy, and Breach Notification Rules, including alignment with NIST SP 800-66 and relevant regulatory audit protocols  NIST Cybersecurity Framework (NIST CSF)  NIST SP 800-53 and control-based federal or regulated-industry assessments  CIS Critical Security Controls  ISO/IEC 27001 and related information security standards  ISO 22301 business continuity management  ISO/IEC 42001 and NIST AI Risk Management Framework (NIST AI RMF)  Data privacy and governance requirements  Cloud-security and cloud-governance assessments  Business continuity, disaster recovery, and business impact analysis  Third-party and supply-chain risk management  Cybersecurity program maturity and governance assessments  Pellera GRC Consultants may perform NIST-aligned GRC programs; PCI DSS ROC assessments & attestations; CMMC readiness, remediation, evidence-validation, and audit-preparation services; cloud-security reviews; data-governance engagements; Cyber Executive Advisory or vCISO services; and resiliency-focused assessments.   Experience with additional frameworks and requirements is highly valued, including:  SOC 1 and SOC 2  SOX and IT general controls  COBIT  HITRUST CSF  FedRAMP and related federal authorization requirements  DFARS and FAR cybersecurity clauses  ISO/IEC 27701  CSA Cloud Controls Matrix and CSA STAR  GDPR, CCPA, CPRA, and other national or state privacy regulations  GLBA, FFIEC, NYDFS Cybersecurity Regulation, NERC CIP, NIS2, TISAX, TX-RAMP, and other industry-specific requirements  While not mandatory, these additional areas reflect frameworks and regulatory requirements that Pellera GRC Consultants have consulted on or have familiarity with.  Provide Strategic GRC Advisory  Help clients establish or mature cybersecurity governance, enterprise risk management, control, compliance, privacy, and assurance programs.  Develop cybersecurity strategies, target operating models, governance structures, policies, standards, procedures, and multi-year roadmaps.  Support vCISO, vDPO, GRC-as-a-Service, and strategic program-management engagements.  Facilitate risk, control, and governance workshops with business and technical stakeholders.  Support executive and board-level reporting on cybersecurity risk, compliance posture, control effectiveness, and improvement progress.  Assist clients with audit preparation, regulatory inquiries, customer assurance requests, and third-party assessments.  Advise on vendor risk management, mergers and acquisitions, security awareness, vulnerability-management governance, incident-response readiness, and cybersecurity investment priorities.  GRC Consultants are embedded into delivery of compliance services, risk services, and governance services, including framework assessments, risk assessments, cloud-security assessments, BCP/DR and BIA work, vCISO/vDPO services, program management, policy development, audit preparation, executive reporting, M&A support, and special projects.   Bridge GRC and Technology  Translate regulatory, contractual, risk, and control requirements into language that cloud, infrastructure, security, application, and business teams can act upon.  Assess how controls are implemented across Microsoft Azure, Microsoft 365, AWS, Google Cloud Platform, SaaS, on-premises, hybrid, and multi-cloud environments.  Review technical evidence involving identity and access management, logging and monitoring, vulnerability management, endpoint protection, network security, encryption, data protection, backup and recovery, secure configuration, and incident response.  Work collaboratively with Pellera specialists across cloud, digital workplace, data protection, cybersecurity engineering, artificial intelligence, infrastructure, and managed services.  Support cloud migration and modernization initiatives where GRC obligations must be integrated into architecture, implementation, and operational processes.  Pellera’s GRC services are blended into many other Pellera provided services including cloud migrations, Cloud FinOps, digital infrastructure and workplace, and GCC High or AWS Gov, and growing Artificial Intelligence enablement initiatives.   Contribute to Practice Growth  Support pre-sales discovery, solution development, project scoping, level-of-effort estimation, proposal development, and client presentations.  Partner with account teams and solution architects to identify the right combination of GRC, cybersecurity, cloud, data-protection, and infrastructure services.  Contribute to reusable methodologies, templates, accelerators, workpapers, and delivery standards.  Mentor other consultants and share knowledge across the practice.  Develop thought leadership, client briefings, webinars, white papers, or conference content when appropriate.  Identify follow-on opportunities based on legitimate client risks, needs, and project findings.  GRC consultants may also be invited to pre-sales discussions because subject matter depth improves GRC discovery and scoping. Team members also contribute to service development, client education, and thought leadership.   Required Qualifications  Fifteen or more years of progressively responsible experience across cybersecurity, information technology, governance, risk, compliance, internal audit, external audit, privacy, or related disciplines. Candidates with a compelling combination of consulting depth, framework expertise, technical knowledge, and leadership experience will also be considered.  Experience working in a consulting, professional services, audit, advisory, or client-facing environment.  Demonstrated ability to independently lead complex cybersecurity or GRC engagements.  Broad knowledge of cybersecurity control frameworks, regulatory requirements, risk-management practices, and audit methodologies.  Experience assessing control design and effectiveness, documenting evidence, developing findings, and presenting practical remediation recommendations.  Strong understanding of IT general controls, control testing, risk assessment, audit evidence, and issue-remediation lifecycle management.  Proven ability to write polished, accurate, executive-ready reports, presentations, policies, roadmaps, and other client deliverables.  Strong verbal communication, interviewing, workshop-facilitation, and presentation skills.  Ability to communicate equally well with executives, auditors, attorneys, compliance leaders, engineers, administrators, and business stakeholders.  Ability to manage multiple client commitments, deadlines, dependencies, and competing priorities while maintaining delivery quality.  Willingness to travel occasionally for client assessments and workshops.  Authorization to work in the United States.  Preferred Qualifications  Working knowledge of Azure, Microsoft 365, AWS, GCP, hybrid-cloud, SaaS, or on-premises enterprise environments.  Experience examining technical configurations or evidence related to identity, network security, endpoint security, vulnerability management, logging, monitoring, encryption, data protection, backup, recovery, and cloud-security controls.  Experience with Microsoft and AWS Commercial & Government Cloud environments, cloud-native security & governance tools, cloud-security posture management, data loss prevention, data classification, and multi-cloud architectures.  Experience with GRC or integrated risk-management platforms such as ServiceNow GRC/IRM, Archer, OneTrust, Vanta, LogicGate, OpenPages, or comparable technologies.  Experience developing cybersecurity metrics, KRIs, KPIs, dashboards, risk registers, control libraries, and executive or board reporting.  Experience with AI governance, AI security, model risk, algorithmic transparency, data privacy, or responsible AI.  Experience performing technical pre-sales, developing SOWs, estimating consulting effort, or supporting solution design.  Experience serving clients in healthcare, retail, restaurants, financial services, insurance, manufacturing, aerospace and defense, technology, higher education, government, hospitality, or other highly regulated industries.  Preferred Certifications  One or more of the following certifications is preferred:  ISACA CISA, CISM, CRISC  IS2 CISSP, CGRC, CCSP  PCI QSA  CMMC Certified Professional, Certified CMMC Assessor, or Registered Practitioner  ISO/IEC 27001 Lead Auditor or Lead Implementer  HITRUST CCSFP or related HITRUST credential  Microsoft Azure and/or AWS security certifications  Other relevant cybersecurity, audit, privacy, cloud, or risk-management certifications  What Success Looks Like  A successful Principal/Senior Consultant will:  Earn client trust through expertise, integrity, responsiveness, and practical advice.  Deliver clear, accurate, well-supported, audit-defensible work.  Convert complex control and regulatory requirements into prioritized actions clients can understand and execute.  Lead engagements with appropriate independence while collaborating effectively with project managers, technical specialists, and other consultants.  Communicate risks and recommendations without unnecessary alarm, jargon, or over-engineering.  Maintain quality and predictability across scope, schedule, deliverables, and client expectations.  Strengthen Pellera’s methodologies by contributing real-world knowledge and reusable intellectual capital.  Help clients achieve measurable reductions in risk, stronger controls, improved audit readiness, and more sustainable governance.  Work Environment and Travel  This is a remote position. Most consulting, analysis, documentation, and project collaboration will be performed remotely. Occasional travel to client locations may be required for onsite assessments, interviews, workshops, observations, evidence validation, or executive presentations. The amount of travel will vary based on the engagement and will be coordinated in advance whenever practical.  Why Join Pellera?  At Pellera, GRC is not an isolated function. It is part of a broader technology and cybersecurity organization with capabilities spanning artificial intelligence, analytics, cloud, digital infrastructure, application modernization, digital workplace, data protection, offensive security, and managed services. That breadth gives GRC consultants the opportunity to help clients not only identify risk, but also connect them with specialists who can help design, implement, and operate solutions. Pellera’s public cybersecurity portfolio similarly positions GRC alongside application and cloud security, cyber resiliency, identity, infrastructure, security operations, and managed services.   The work is varied and substantive. Consultants may help a defense contractor prepare for CMMC, lead a PCI DSS assessment for a large retail environment, assess healthcare security and privacy controls, evaluate an Azure or Microsoft 365 tenant, design an enterprise GRC operating model, develop an AI risk-governance program, or advise executives on a multi-year cybersecurity roadmap.   With over 3,200 employees, Pellera is an enterprise technology partner combining digital infrastructure and workplace, hybrid cloud, cybersecurity, and artificial intelligence capabilities, delivered through its Advise, Implement, and Manage approach.