Title: Senior Cyber Risk & Compliance Analyst
Location : Remote
Target Start Date : ASAP (must be readily available, looking to start week of 11/2)
Type: Contract
Pay Rate : $75.00-$85.00/hr
Summary
Our client is seeking a Senior Cyber Risk & Compliance Analyst to strengthen cybersecurity governance, risk management, compliance, audit readiness, and technical assurance across the enterprise. This senior individual contributor will combine strong GRC expertise with practical technical knowledge across infrastructure, applications, identity, cloud, and business processes.
The role will translate technical vulnerabilities, control deficiencies, audit findings, and regulatory requirements into defensible risk decisions, prioritized remediation plans, measurable outcomes, and clear executive reporting. Key areas include Drata, ISO/IEC 27001, TISAX, NIST Cybersecurity Framework, SOX IT General Controls, vulnerability management, third-party risk, identity governance, and operational resilience.
Key Requirements
- Lead cybersecurity risk assessments, maintain risk registers, and manage risk treatment plans, exceptions, corrective actions, and closure evidence.
- Administer and mature Drata or a comparable GRC platform, including controls, frameworks, evidence, testing, ownership, workflows, and integrations.
- Support readiness and gap assessments across ISO/IEC 27001, TISAX, NIST CSF, and SOX ITGC requirements and develop practical remediation roadmaps.
- Coordinate internal and external IT/cybersecurity audits, evaluate control design and operating effectiveness, and drive findings through remediation and closure.
- Coordinate penetration testing and vulnerability remediation, validating severity, business impact, ownership, compensating controls, and retesting.
- Develop and maintain cybersecurity policies, standards, procedures, control requirements, and framework mappings.
- Assess identity and access controls, privileged access, provisioning/deprovisioning, segregation of duties, change management, logging, monitoring, backup, and recovery controls.
- Partner with infrastructure, application, cloud, engineering, identity, and vendor teams to address high-risk findings and improve security posture.
- Perform cybersecurity reviews of technology providers and support third-party risk, business continuity, disaster recovery, and operational resilience programs.
- Develop risk indicators, dashboards, governance materials, and executive-level reporting.
- Lead cross-functional governance activities and communicate complex technical and regulatory issues to both technical and business stakeholders.
Required Qualifications- Bachelor's degree in cybersecurity, information technology, computer science, management information systems, or a related field.
- 8+ years of progressive experience across IT, cybersecurity, audit, risk, or compliance, including meaningful hands-on technical responsibility.
- Demonstrated progression from technical IT or security work into cybersecurity governance, risk, compliance, audit, or security leadership.
- Practical experience with ISO/IEC 27001 and NIST-based cybersecurity frameworks.
- Experience supporting internal and external IT/cybersecurity audits and evaluating control design and operating effectiveness, including SOX ITGC.
- Experience managing vulnerability or penetration-testing findings through remediation, validation, and closure.
- Working knowledge of identity and access management, Windows/Linux infrastructure, network security, enterprise applications, cloud services, logging/monitoring, system hardening, and incident response.
- Experience developing policies, standards, procedures, risk records, audit evidence, and executive reporting.
- Strong cross-functional leadership and communication skills, with the ability to clearly communicate risk to technical and nontechnical audiences.
- Ability to work in the Eastern Time Zone.
Preferred Qualifications- Master's degree in cybersecurity, information security, IT, or a related discipline.
- ISO/IEC 27001 Lead Implementer, Lead Auditor, CISA, CISM, CRISC, or comparable certification.
- Hands-on experience implementing, administering, or materially improving Drata or another enterprise GRC platform.
- TISAX or comparable security assurance/certification experience in manufacturing, automotive, engineering, or other complex enterprise environments.
- Experience designing, operating, testing, auditing, or remediating SOX IT General Controls.
- Experience with security for SAP, SAP IAM, Oracle, or other major ERP/business-critical application environments.
- Experience with critical infrastructure, OT, ICS, SCADA, or manufacturing technology security.
- Experience with business continuity, disaster recovery, business impact analysis, recovery objectives, or operational resilience.
- Experience working in a large, geographically distributed, regulated, manufacturing, or otherwise complex enterprise environment.
Impact
This role will help strengthen the organization's overall cybersecurity posture by connecting technical security issues, business risk, compliance requirements, and executive decision-making. The successful candidate will improve the maturity of GRC processes, increase audit and certification readiness, accelerate remediation of material risks, and establish sustainable controls and governance practices across the enterprise.
Welcome to ConsultNet, a premier national provider of technology talent and solutions. Our expertise spans across project services, contract-to-hire, direct search, and managed services onshore, nearshore, and hybrid. For over 25 years, we have connected thousands of consultants with meaningful roles through a personal, communication-driven approach, partnering with a diverse client base to build high-performing teams and create lasting impact. Our comprehensive service offerings cover a wide range of technology and engineering positions across key markets nationwide. Learn more at .
We champion equality and inclusivity, proudly supporting an Equal Opportunity Employer policy. We welcome applicants regardless of Race, Color, Religion, Sex, Sexual Orientation, Gender Identity, National Origin, Age, Genetic Information, Disability, Protected Veteran Status, or any other status protected by law.