Risk Advisory GRC Intern - Remote

About us:

At Echelon Risk + Cyber, we believe in defending basic human rights to security and privacy. If you are a university student in your final three semesters and you're looking to kickstart your career in cybersecurity and consulting, this is the perfect opportunity for you. We are looking for an exceptional Risk Advisory GRC Intern to support the delivery of governance, risk, and compliance engagements while learning how organizations build, measure, and improve their security programs.

As a Risk Advisory GRC Intern , you won't just observe . You will work on real client engagements alongside experienced consultants, and you will learn how frameworks, evidence, and risk analysis come together to produce an assessment a client can act on. Our work spans readiness assessments, gap analyses, policy development, third-party risk, and AI governance, across industries such as healthcare, financial services, higher education, and the defense industrial base.

At Echelon, we believe learning never stops. You will work with the tools and frameworks clients rely on today, and with team members who will challenge you with meaningful work. We allow our team members to build from the ground up and make an impact across the organization.

Application Details:
This internship is part of our Summer 2027 Internship Program and will run from June 7, 2027, through August 12, 2027. Interns are expected to work approximately 20–25 hours per week throughout the duration of the program. Compensation ranges from $15–$20 USD per hour, depending on relevant experience.

What You Will Do:

• Support control, gap, and maturity assessments aligned to frameworks such as NIST CSF, NIST 800-171, ISO 27001, SOC 2, HIPAA, PCI DSS, CIS Controls, and CMMC.
• Gather, organize, and analyze client evidence, and document how it supports or fails to support each control.
• Draft assessment work papers and report sections under the guidance of senior consultants, with attention to clear and accurate writing.
• Help build and maintain risk registers, remediation plans, and maturity roadmaps.
• Assist with drafting and reviewing security policies, standards, and procedures.
• Support third-party risk management work, including vendor questionnaires and review of vendor documentation.
• Learn how GRC platforms such as Vanta and Drata are used to track controls, evidence, and audit readiness.
• Gain exposure to AI governance work, including NIST AI RMF and ISO 42001 aligned assessments.
• Shadow consultants on client calls and interviews to learn how engagements are scoped, run, and communicated.
• Participate in internal team meetings to learn engagement planning, risk discussions, and advisory approaches.
• Research cybersecurity trends, frameworks, and regulatory requirements, and share what you learn with the team.
• Assist leadership with proposals, internal process improvement, and thought leadership content such as blog posts and knowledge sharing.

Your knowledge, skills, and abilities:

• Strong interest in risk advisory and GRC, and a foundational understanding of cybersecurity principles.
• Currently pursuing a degree in IT, Cybersecurity, Business, Finance, or a related field.
• Advanced proficiency in English (verbal and written).
• Strong organizational skills to manage multiple projects and priorities.
• Attention to detail and strong analytical and problem-solving skills, including comfort reading dense control language and judging whether evidence meets it.
• Excellent communication skills, with the ability to tailor messages for diverse audiences.
• Comfort working independently in a remote-first, multinational team.
• Aspiration to work in the cybersecurity industry within the next two years.
• Availability to work a minimum of 20 hours per week (8 AM-5 PM CST,…