Enterprise Controls Consultant - GRC;

Location: Philadelphia, PA (Hybrid – Onsite Tuesday–Thursday)
Duration: 12-Month Contract

This position is centered on cybersecurity controls engineering and design
—not operational security or incident response.

The successful candidate will be responsible for designing, documenting, and supporting the implementation of cybersecurity controls aligned with industry frameworks including NIST 800-53, NIST CSF, CIS Controls, ISO 27001/27002, COBIT, and internal security standards.

Candidates must be comfortable:

• Designing new cybersecurity controls and modernizing existing control frameworks.
• Translating security policies, regulatory requirements, and technical standards into practical, measurable controls.
• Defining control objectives, implementation guidance, testing procedures, and evidence requirements.
• Working directly with control owners and cross-functional stakeholders to finalize and implement enterprise security controls.
• Building controls that support automation, governance, and Continuous Controls Monitoring (CCM).

This is not a "heads-down" cybersecurity engineering or SOC role. The hiring manager is looking for a senior consultant who can lead control design discussions, influence stakeholders, and build scalable governance frameworks—not simply operate or maintain existing controls.

We are seeking an experienced Technical Consultant – Cybersecurity Governance & Controls to support a large-scale Governance, Risk & Compliance (GRC) Modernization Program
. This consultant will play a key role in redesigning and modernizing the organization's cybersecurity control environment by creating standardized, scalable, and measurable security controls.

The ideal candidate has a strong background in Cybersecurity Governance, GRC, Controls Design, Risk Management, Compliance, or Internal Audit
, with proven experience transforming control frameworks within highly regulated organizations.

You will partner with Security, Technology, Risk, Compliance, Internal Audit, and business leaders to simplify legacy controls, establish future-state governance, and enable automation and Continuous Controls Monitoring (CCM).

• Design, document, and support implementation of cybersecurity controls aligned to NIST 800-53, NIST CSF, CIS Controls, ISO 27001/27002, COBIT, and internal standards.
• Assess current security controls through review of policies, standards, procedures, risk assessments, audit findings, and regulatory requirements.
• Identify control gaps, redundancies, inconsistencies, and opportunities for standardization.
• Translate security policies, regulatory requirements, and risk assessments into practical, measurable, and auditable control designs.
• Define control objectives, ownership, implementation guidance, testing criteria, and evidence requirements.
• Facilitate workshops with Security, Technology, Risk, Compliance, Internal Audit, and business stakeholders to gather requirements and drive consensus.
• Build and enhance enterprise control libraries, taxonomies, and framework mappings.
• Design controls with automation and Continuous Controls Monitoring (CCM) capabilities in mind.
• Partner with GRC modernization teams to improve governance processes, control maturity, and regulatory readiness.
• Identify opportunities to leverage AI, analytics, and automation to strengthen governance and compliance processes.

• 8+ years of experience in Cybersecurity Governance, GRC, Controls Design, Risk Management, Compliance, or Internal Audit.
• Proven experience designing or transforming cybersecurity, technology, or enterprise risk controls.
• Strong experience creating controls aligned to NIST 800-53, NIST CSF, CIS Controls, ISO 27001/27002
  , or similar frameworks.
• Demonstrated ability to translate security policies, standards, audit findings, and regulatory requirements into effective enterprise controls.
• Experience defining control objectives, testing methodologies, implementation guidance, and evidence requirements.
• Experience collaborating directly with control owners and senior stakeholders to implement new control frameworks.
• Strong understanding of the…