Grc Consultant

Job Description GRC Policy & Standards Specialist

Experience: 6 10 years Level: Mid-Level / Senior Consultant Role: GRC Policy, Standards & Governance Consultant

Role Overview We are looking for a strong GRC Policy & Standards Specialist to develop, enhance, and operationalize enterprise governance documentation across security, technology, risk, and operational functions.

The successful candidate will have demonstrated experience developing enterprise policies, standards, control requirements, procedures, and supporting governance documentation that are clear, structured, actionable, and aligned with recognized regulatory and industry frameworks.

This role requires more than strong writing skills. The individual must understand what constitutes effective GRC documentation, including appropriate distinctions between policies, standards, procedures, controls, and guidelines, and be able to translate complex regulatory, risk, security, technology, and operational requirements into documentation that can be practically implemented.

A critical part of the role will be working across organizational boundaries. The individual must be comfortable engaging with technology, cybersecurity, operations, risk, compliance, legal, and business stakeholders, reconciling different perspectives, challenging unclear requirements, and driving documentation through review, approval, and adoption.

Key Responsibilities

• Lead the development, review, and enhancement of enterprise GRC policies, standards, procedures, control requirements, and governance documentation.
• Establish consistent documentation structures, terminology, requirements language, and governance conventions across policies and standards.
• Translate regulatory, risk, security, technology, and business requirements into clear, enforceable, and operationally practical policy and standards requirements.
• Ensure appropriate distinction and traceability between policy statements, standards requirements, control objectives, procedures, and supporting guidance.
• Work directly with subject matter experts across technology, cybersecurity, operations, risk, compliance, legal, privacy, and business functions to develop and validate requirements.
• Facilitate working sessions and stakeholder reviews to identify requirements, resolve conflicting requirements, close documentation gaps, and achieve agreement on governance expectations.
• Convert complex technical requirements into language that can be understood by business and operational stakeholders while maintaining sufficient specificity for technology and control owners.
• Ensure policy and standards requirements are written in a manner that is measurable, auditable, and capable of being translated into controls and operational processes.
• Support the mapping of policies and standards to regulatory obligations, control frameworks, risks, and enterprise requirements.
• Partner with control owners and operational teams to ensure documented requirements can be realistically implemented and evidenced.
• Identify gaps between documented requirements and current operational or technology practices and help define appropriate remediation actions.

Required Experience

• 6 10 years of experience across policy governance, GRC, cybersecurity governance, compliance, technology and enterprise risk.
• Demonstrated experience authoring and substantially revising enterprise policies and standards, rather than solely reviewing documentation created by others.
• Strong understanding of what constitutes effective and enforceable GRC and governance documentation.
• Ability to write requirements that are clear, concise, enforceable, testable, and appropriately prescriptive.
• Strong understanding of GRC concepts including risk management, control design, compliance, assurance, issue management, exceptions, and governance oversight.
• Ability to understand technical concepts and work effectively with technology, architecture, engineering, cybersecurity, and IT operations teams without needing to be a hands-on engineer.
• Ability to work with operational and business stakeholders to understand processes, identify practical requirement gaps, and ensure governance requirements are usable outside of GRC.
• Experience translating regulatory, framework, security, or risk requirements into enterprise policy, standards, and control language.
• Strong stakeholder management skills, including the ability to facilitate discussions involving management-level+ stakeholders.
• Excellent written communication, editing, analytical, and information-structuring skills.
• Strong attention to detail and ability to identify ambiguous language, inconsistent requirements, documentation gaps, and conflicting governance expectations.
• Confidence working directly with senior leaders, subject matter experts, control owners, and second-line risk and compliance functions.

Preferred Experience Experience with several of the following would be valuable:

• NIST CSF / NIST 800-series
• ISO/IEC 27001 and 27002
• ISO/IEC 42001
• NIST AI RMF
• SOC 2
• Privacy and data governance frameworks
• Third-party risk management
• Secure software development and technology governance
• Cloud and infrastructure security standards
• AI and emerging technology governance
• Regulatory compliance frameworks
• GRC platforms and policy management tools

Most Important Profile

• We are not looking for a technical writer who simply documents information provided by subject matter experts, nor are we looking for a purely technical security or engineering resource.
• We need someone who understands governance, risk, controls, and enterprise policy architecture and can independently determine what strong policy and standards documentation should look like.
• The ideal candidate can sit with a cybersecurity architect, technology leader, operational process owner, risk professional, or compliance SME; understand their requirements; challenge ambiguity or impractical expectations; and translate those discussions into clear, defensible, implementable, and auditable enterprise requirements.
• Strong candidates should be able to operate as both a governance subject matter expert and a skilled policy author, while effectively navigating stakeholders across business, operations, risk, security, and technology

For applications and inquiries,