Consultant - GRC

Job Description

Key Responsibilities Governance and Policy Development oDevelop and implement governance frameworks, policies, and procedures to ensure alignment with industry standards and organizational objectives. oRegularly review and update GRC policies based on regulatory changes, client requirements, and industry best practices. oCreate and maintain documentation for governance, risk, and compliance initiatives, ensuring accessibility and adherence across the organization. Client Due Diligence and Risk Assessment oManage and respond to client due diligence and security assessments, providing accurate, timely information about the organization's risk management, security posture, and compliance practices. oCoordinate with relevant teams to compile necessary documentation and evidence to address client inquiries regarding data protection, privacy practices, and information security controls. oConduct risk assessments based on client requirements, identifying and addressing potential gaps to ensure continued alignment with client security expectations. Vendor Risk Assessment and Management oConduct thorough vendor risk assessments to evaluate the security posture and compliance of third-party vendors. oCollaborate with the procurement and legal teams to review vendor agreements, ensuring they meet the organization’s GRC and security standards. oMonitor and maintain the vendor risk register, tracking vendor compliance, and conducting periodic reassessments for critical vendors. Risk Assessment and Mitigation oLead and conduct internal risk assessments, identifying and analysing potential risks to the organization’s assets and operations. oDevelop and implement risk treatment plans in collaboration with stakeholders, tracking and reporting on risk mitigation efforts. oMaintain the organizational risk register and work with cross-functional teams to ensure continuous monitoring and timely response to emerging risks. Compliance Management and Regulatory Oversight oEnsure compliance with relevant standards and regulations, such as ISO 27001 (ISMS), ISO 27701 (PIMS), ISO 27017, ISO 27018, ISO 42001 (AI oManagement Framework), CCPA, NIST, GDPR, PCI-DSS, CIS Benchmarks. oSupport internal and external compliance audits, control testing, and regulatory assessments, and coordinate with departments to gather required documentation. oStay updated on regulatory requirements and communicate changes in compliance obligations to relevant stakeholders. Control Implementation and Monitoring oDesign, implement, and assess controls to ensure they align with GRC policies and regulatory requirements. oConduct regular control testing and monitor control effectiveness, identifying and remediating any deficiencies. oCollaborate with teams to improve and strengthen internal controls across the organization. Incident Response and Analysis oSupport the incident response process by providing guidance during incidents and conducting post-incident reviews to ensure alignment with GRC frameworks. oRegularly review and update incident response plans and playbooks, incorporating lessons learned from security incidents to enhance future response efforts. Training, Awareness, and Stakeholder Engagement oDevelop and deliver training sessions on GRC-related topics, increasing organizational awareness of risk, compliance, and security responsibilities. oCollaborate with Legal, IT, HR, and other departments to ensure integrated and effective GRC practices. oCommunicate risk assessment results, policy updates, and compliance requirements to stakeholders and senior management. Documentation, Reporting, and Metrics oMaintain comprehensive documentation for all GRC activities, including client and vendor assessments, internal audits, risk assessments, and compliance reviews. oCreate and present reports, metrics, and dashboards to communicate GRC status, control effectiveness, and compliance progress to senior management. oDocument and track risk assessment outcomes, client inquiries, and remediation actions to ensure transparent and effective risk management practices. Show more Show less