Sr. Consultant - Strategy & Risk | Remote, USA

Role overview Advise organizations on cybersecurity strategy, risk, and compliance, combining technical understanding with client-facing consulting. The work ranges from assessing current security and governance practices to designing target operating models, prioritized roadmaps, and practical controls. A key focus includes emerging AI risks, alongside broader enterprise security and resilience programs.

Responsibilities - Assess risks from AI, including generative and third-party tools, and recommend governance policies, acceptable-use standards, oversight, and mitigations. - Lead or contribute to strategy engagements that evaluate current capabilities and define target states, transformation plans, and investment priorities. - Review security and compliance against applicable frameworks; perform risk assessments, readiness reviews, gap analyses, and third-party assessments. - Help build GRC practices such as risk registers, control mapping, evidence collection, issue handling, and remediation tracking. - Develop or improve security policies, risk frameworks, program plans, and remediation plans; translate technical findings into business implications. - Facilitate interviews, workshops, and presentations, document recommendations, support knowledge transfer, and assist other consultants on complex engagements.

Requirements - Bachelor’s degree and approximately 5–7 years of related experience; consulting experience is preferred. - Experience with cybersecurity strategy, risk management, security assessments, compliance, policies, or governance programs. - Working knowledge of frameworks such as NIST, ISO 27001, CMMC, CIS, PCI, or HIPAA. - Strong analytical, writing, presentation, and client communication skills; able to manage multiple projects independently. - Relevant professional certification such as CISSP, CISM, or CISA; the successful candidate is expected to hold related credentials. - U.S. driver’s license and willingness to travel for client needs.

Nice to have - Experience with GRC platforms, third-party risk, cyber resilience, business continuity, disaster recovery, or operational resilience. - Credentials such as CRISC, CCSP, CMMC CCP/CCA, or ISO 27001 Lead Implementer.

Benefits and work setup Fully remote within the continental United States. The role offers work-life balance, professional training, employee resource groups, volunteer opportunities, and varied client projects.