Senior GRC, Technical Controls & AI Risk

Senior GRC, Technical Controls & AI Risk

Location-Type: Remote
Start Date Is: ASAP
Duration: (contract, perm, etc)6

Month Contract (option to extend or convert)
Compensation Range: $70-80/hour W2
Benefits: Eligible for Health, Dental, Vision, 401K
Must be authorized to work in the U.S. This position is not eligible for sponsorship

We are seeking a senior Governance, Risk and Compliance professional to lead technical control reviews, testing, evidence evaluation, risk analysis, and remediation planning across cybersecurity. This role will partner with security engineering, architecture, IAM, vulnerability management, incident response, cloud, application security, data protection, and business teams.

The ideal candidate is a strong GRC generalist with sufficient technical depth to understand how controls operate, challenge evidence, identify root causes, assess residual risk, and develop practical remediation plans. The role will also support AI governance and risk management.

• Conduct technical control reviews and assessments across cybersecurity domains, including IAM, vulnerability management, security operations, incident response, cloud, infrastructure, application security, data protection, and third-party risk.
• Design and execute control testing, evaluating control design, operating effectiveness, scope, frequency, ownership, and evidence quality.
• Review and challenge audit evidence, system reports, tickets, configurations, testing results, and management assertions.
• Identify control gaps, deficiencies, recurring issues, exceptions, and root causes.
• Develop risk-based remediation plans with owners, milestones, dependencies, success criteria, and sustainable corrective actions.
• Assess inherent risk, control effectiveness, compensating controls, residual risk, and risk acceptance decisions.
• Support internal and external audits, regulatory assessments, customer assurance requests, and certification activities.
• Map requirements across NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, and applicable regulatory requirements.
• Develop and maintain policies, standards, control objectives, risk statements, assessment methodologies, and evidence requirements.
• Produce risk dashboards, control maturity assessments, issue and exception reporting, and executive recommendations.
• Improve control adoption, evidence quality, repeatable testing, and continuous monitoring using Service Now IRM, Hyperproof, and Vanta.
• Support AI governance, including AI use-case assessments, AI risk and control matrices, responsible AI, model and data risks, third-party AI, agentic AI, security, privacy, transparency, human oversight, and lifecycle governance.
• Apply ISO/IEC 42001 and the NIST AI Risk Management Framework to AI governance and control design.
• Advise technical and business stakeholders on risk trade-offs, remediation options, and control requirements.

• 8-13 years of experience in cybersecurity GRC, IT risk, IT audit, internal controls, compliance, security assurance, or a related discipline.
• Experience performing technical control assessments and testing across multiple cybersecurity domains.
• Strong knowledge of control design, operating effectiveness, evidence evaluation, risk analysis, issue management, exceptions, and remediation planning.
• Ability to interpret technical evidence from IAM, vulnerability, incident, cloud, application security, infrastructure, and operational environments.
• Experience with NIST, ISO 27001, SOC 2, COBIT, or comparable frameworks.
• Strong written and verbal communication skills, including the ability to explain technical risk to business and executive stakeholders.
• Experience with Service Now IRM, Hyperproof, or Vanta.
• Preferred Qualifications
• CISA, CIA, CISSP, CRISC, CISM, or comparable certification; CISA, CIA, and CISSP are particularly desirable.
• Experience with ISO/IEC 42001, NIST AI RMF, AI governance, AI risk assessments, or AI control frameworks.
• Experience developing AI risk and control matrices or assessing AI use cases, models, data, vendors, and agentic AI implementations.
• Experience with control automation, continuous control monitoring, data analytics, or control-as-code concepts.
• Experience supporting global, regulated, or complex enterprise environments.