ZipRecruiter

Log In

1

Grc Consulting Jobs (NOW HIRING)

Hotman Group LLC

Entry Level GRC Analyst

Fort Worth, TX · On-site +1

About the Role Hotman Group is a boutique cybersecurity and GRC consulting firm doing meaningful work for clients who need GRC done right ranging from Fortune 1000 companies to high-growth startups.

Hotman Group

Entry Level GRC Analyst

Fort Worth, TX

About the Role Hotman Group is a boutique cybersecurity and GRC consulting firm doing meaningful work for clients who need GRC done right ranging from Fortune 1000 companies to high-growth startups.

Hotman Group

Entry Level GRC Analyst

Fort Worth, TX

About the Role Hotman Group is a boutique cybersecurity and GRC consulting firm doing meaningful work for clients who need GRC done right ranging from Fortune 1000 companies to high-growth startups.

C4 Technical Services

GRC Consultant

Minneapolis, MN · On-site

IT Consultant - GRC Overview: Seeking a process-focused GRC Consultant to align business objectives with security investments, strengthen risk management practices, and enhance governance frameworks.

Thrive

Consultant, GRC Services

Tampa, FL · On-site

The GRC Consultant supports the Assessment, Program Establishment, and Support work required for ... Experience working in a client-facing consulting or service delivery capacity * Experience managing ...

Thrive

Consultant, GRC Services

Tampa, FL · On-site

The GRC Consultant supports the Assessment, Program Establishment, and Support work required for ... Experience working in a client-facing consulting or service delivery capacity * Experience managing ...

DivIHN

Senior ServiceNow GRC Consultant

Senior ServiceNow GRC Consultant Location: Remote Duration: 6 Months with possibility of extension Working Hours: 37.5 hours per week, with 7.5 hours per day Onsite presence during 1st week is ...

Hotman Group

Experienced or Senior GRC Analyst

Fort Worth, TX · Remote

$84K - $111K/yr

About the Role Hotman Group is a boutique cybersecurity and GRC consulting firm doing meaningful work for clients who need GRC done right ranging from Fortune 1000 companies to high-growth startups.

next page

Showing results 1-20

All JobsGrc Consulting Jobs

Grc Consulting information

See salary details

$44

$76

$100

How much do grc consulting jobs pay per hour?

As of Aug 4, 2026, the average hourly pay for grc consulting in the United States is $76.99, according to ZipRecruiter salary data. Most workers in this role earn between $67.55 and $87.98 per hour, depending on experience, location, and employer.

What are the key skills and qualifications needed to thrive as a GRC consultant?

To thrive as a GRC (Governance, Risk, and Compliance) Consultant, you need a solid understanding of risk management frameworks, regulatory requirements, and audit processes, often supported by a degree in business, information security, or a related field. Familiarity with GRC platforms (such as RSA Archer or ServiceNow), knowledge of ISO 27001/9001, and relevant certifications like CISA, CISM, or CRISC are highly valued. Strong analytical thinking, communication, and stakeholder management skills help you translate complex regulations into actionable business practices. These competencies are vital for ensuring organizations remain compliant, mitigate risks, and maintain operational integrity.

What is the difference between Grc Consulting vs Risk Analyst?

AspectGrc ConsultingRisk Analyst
Required CredentialsCertifications like CISA, CISM, or CRISC often preferredCertifications such as FRM, CRM, or CIA common
Work EnvironmentAdvisory roles, client sites, corporate officesFinancial institutions, corporations, or consulting firms
Employer & Industry UsageConsulting firms, large corporations, government agenciesFinancial services, insurance, banking, corporate sectors

Grc Consulting and Risk Analysts both focus on managing and assessing risks, but Grc Consulting typically involves advising organizations on governance, risk, and compliance strategies across multiple areas, while Risk Analysts primarily analyze specific risks within financial or operational contexts. Grc Consultants often work across various industries and provide strategic guidance, whereas Risk Analysts tend to focus on data analysis and risk measurement within specific sectors.

What are some of the most common challenges faced by GRC consultants when working with clients to implement compliance frameworks?

GRC consultants often encounter challenges such as navigating complex regulatory landscapes, addressing gaps in clients' existing processes, and overcoming resistance to change within organizations. Each client may have unique business processes and risk appetites, requiring tailored solutions and strong communication skills. Additionally, aligning stakeholder interests and ensuring ongoing commitment to compliance initiatives are crucial for successful framework implementation.

Are GRC consulting jobs hard to get?

GRC consulting jobs can be competitive due to the specialized skills required, such as knowledge of governance, risk management, and compliance frameworks. Candidates with relevant certifications like CISA or CISSP, strong analytical skills, and experience with regulatory standards often have better chances of securing these roles.

What is GRC consulting?

GRC consulting refers to advisory services that help organizations effectively manage Governance, Risk, and Compliance (GRC). GRC consultants assist businesses in aligning their strategies, processes, and technologies to ensure they meet regulatory requirements, mitigate risks, and achieve organizational objectives. These consultants often evaluate existing frameworks, recommend improvements, and help implement tools and policies to create a strong compliance culture. Their expertise spans areas such as data privacy, cybersecurity, internal controls, and corporate governance. Working with a GRC consultant can help organizations reduce risk exposure and improve operational efficiency.

What does a GRC consulting do?

A GRC (Governance, Risk, and Compliance) consultant helps organizations develop and implement strategies to manage risks, ensure regulatory compliance, and establish effective governance frameworks. They analyze business processes, assess risks, and recommend policies, often using tools like risk management software and frameworks such as ISO or COBIT. GRC consultants typically require strong analytical skills and knowledge of industry regulations.

Is GRC consulting in high demand?

GRC (Governance, Risk, and Compliance) consulting is in high demand due to increasing regulatory requirements and the need for organizations to manage cybersecurity risks. Professionals in this field with skills in risk assessment, compliance frameworks, and security tools are sought after across various industries.

How much do GRC consultants make?

GRC (Governance, Risk, and Compliance) consultants typically earn between $70,000 and $130,000 annually, depending on experience, certifications, and location. Senior consultants with specialized skills or certifications like CISSP or CISA can earn higher salaries, often exceeding $150,000. Compensation also varies based on the industry and consulting firm size.
More about Grc Consulting jobs
What cities are hiring for Grc Consulting jobs? Cities with the most Grc Consulting job openings:
What states have the most Grc Consulting jobs? States with the most job openings for Grc Consulting jobs include:
What job categories do people searching Grc Consulting jobs look for? The top searched job categories for Grc Consulting jobs are:
Grc Consulting jobs near you
Infographic showing various Grc Consulting job openings in the United States as of July 2026, with employment types broken down into 92% Full Time, 4% Part Time, and 4% Contract. Highlights an 86% Physical, 4% Hybrid, and 10% Remote job distribution, with an average salary of $160,135 per year, or $77 per hour.

Senior vCISO / GRC Consulting Manager

Agency Cybersecurity

Richmond, VA • On-site

$125K/yr

Full-time

Medical, Retirement, PTO

Re-posted 27 days ago

Job description

About Agency Cybersecurity:
Agency Cybersecurity is fast growing ventured back startup that provides best-in-class cybersecurity and compliance. Our software and services simplify complex compliance frameworks including SOC2, ISO 27001, HIPAA, and others, empowering businesses to scale securely and confidently. We're backed by top tier investors like Y Combinator and have offices in NYC, Boston, Richmond, and London.
Location: Richmond, VA (100% In person)
Employment Type: Salaries, Full-Time
Compensation: $125,000 base salary
About the Role
We are seeking a Senior vCISO / GRC Consulting Manager to lead client-facing cybersecurity, governance, risk, and compliance engagements for organizations pursuing or maintaining security frameworks such as NIST 800-171, 800-53, or CMMC. As well as experience with SOC 2, ISO 27001, and related trust and security standards.
This is an in-person consulting leadership role based in Richmond, VA. The Senior vCISO will work directly with clients, internal delivery teams, and company leadership to provide hands-on advisory support, manage GRC engagements, and lead a team responsible for delivering high-quality cybersecurity and compliance services.
The Senior vCISO will serve as a strategic advisor to clients, helping them understand their security and compliance obligations, prioritize risk, prepare for audits, implement practical controls, and build scalable security programs. This person will also manage a team of GRC consultants, analysts, and implementation specialists responsible for delivering client work.
The ideal candidate has at least 6 years of professional experience in GRC, cybersecurity compliance, audit readiness, or related advisory work, including at least 4 years in a management or team leadership role. This person should be comfortable advising executives, managing client relationships, leading teams, working with auditors, and translating complex security and compliance requirements into clear business actions.
Key Responsibilities
Client Advisory and vCISO Leadership
  • Serve as a trusted vCISO advisor to clients across cybersecurity, governance, risk, and compliance matters.
  • Provide practical guidance to executive teams, founders, security leaders, IT teams, and business stakeholders.
  • Help clients understand what they need to do to improve security, pass audits, reduce risk, and satisfy customer requirements.
  • Advise clients on security program design, risk prioritization, compliance strategy, policy development, and control implementation.
  • Lead client meetings, executive briefings, audit readiness sessions, and risk review discussions.
  • Translate technical and compliance requirements into clear, business-friendly recommendations.

GRC and Compliance Program Delivery
  • Lead client engagements related to SOC 2, ISO 27001, and other audited security frameworks.
  • Develop and manage compliance roadmaps, audit readiness plans, and remediation timelines for clients.
  • Guide clients through the full lifecycle of compliance readiness, including scoping, gap assessments, control implementation, evidence collection, audit support, and ongoing maintenance.
  • Help clients determine the right level of security and compliance maturity for their size, industry, customer expectations, and business goals.
  • Ensure compliance programs are practical, defensible, and not unnecessarily burdensome.

Audit Readiness and Framework Management
  • Lead SOC 2 Type 1 and Type 2 readiness initiatives for clients.
  • Support ISO 27001 implementation, certification preparation, surveillance audit readiness, and continuous improvement.
  • Coordinate with external auditors, assessors, client stakeholders, and internal delivery teams.
  • Review audit evidence, control documentation, risk registers, policies, and remediation plans.
  • Help clients understand audit findings and develop clear plans to address gaps.
  • Maintain strong working knowledge of SOC 2 Trust Services Criteria, ISO 27001 requirements, and common security control expectations.

Team Management and Delivery Oversight
  • Manage a team of GRC consultants, analysts, and implementation resources.
  • Assign work, oversee deliverables, manage deadlines, and ensure consistent quality across client engagements.
  • Coach and mentor team members on GRC consulting, client communication, audit readiness, and control implementation.
  • Review team deliverables, including gap assessments, policies, risk registers, audit evidence, project plans, and client-facing reports.
  • Ensure the team delivers work that is accurate, practical, professional, and aligned with client expectations.
  • Build repeatable delivery processes, templates, playbooks, and quality standards for the consulting team.

Security Control and Risk Advisory
  • Advise clients on the design, implementation, and improvement of security and compliance controls.
  • Help clients assess risks across cloud infrastructure, identity and access management, endpoint security, vulnerability management, vendor risk, change management, incident response, and secure development practices.
  • Maintain and improve client risk registers and remediation plans.
  • Work with client technical teams to prioritize security improvements based on business impact, audit requirements, and real-world risk.
  • Provide practical recommendations that balance security, compliance, cost, and operational complexity.

Policy, Governance, and Documentation
  • Lead the development and review of client security policies, procedures, standards, and governance documentation.
  • Help clients implement policy review cycles, access review processes, vendor review workflows, risk acceptance procedures, and other governance activities.
  • Ensure client documentation aligns with actual business practices and audit expectations.
  • Help clients avoid "paper compliance" by tying policies and controls to real operational processes.

Customer Trust and Security Questionnaire Support
  • Advise clients on customer security reviews, vendor assessments, and trust-related requests.
  • Help clients respond to security questionnaires, customer due diligence requests, and enterprise procurement reviews.
  • Support the development of reusable security and compliance response libraries.
  • Help clients use compliance and security posture to support sales, customer trust, and enterprise readiness.

Client Relationship Management
  • Own or support client relationships across multiple GRC and vCISO engagements.
  • Set clear expectations with clients regarding scope, timelines, responsibilities, and deliverables.
  • Identify client risks, blockers, and expansion opportunities.
  • Communicate engagement status, risks, and next steps clearly to both internal leadership and client stakeholders.
  • Ensure clients receive strategic advice, not just task completion.

Required Qualifications
  • Minimum 6 years of professional experience in GRC, cybersecurity compliance, security advisory, audit readiness, IT risk, internal audit, or a related field.
  • Minimum 4 years of management or team leadership experience.
  • Direct experience advising organizations on audited frameworks such as SOC 2 and ISO 27001.
  • Experience managing client-facing consulting engagements or advisory relationships.
  • Strong understanding of security controls, risk management, compliance frameworks, and audit processes.
  • Experience leading or supporting external audits, including evidence collection, control testing, auditor communications, and remediation.
  • Ability to explain complex security and compliance concepts to executives, founders, technical teams, and non-technical stakeholders.
  • Strong written and verbal communication skills.
  • Strong project management skills with the ability to manage multiple clients, deadlines, stakeholders, and team members.
  • Ability to work in person from Richmond, VA.
  • Willingness to attend in-person meetings with internal teams, clients, and leadership as required.

Preferred Qualifications
  • Prior experience in a consulting, advisory, MSSP, vCISO, CPA firm, audit firm, cybersecurity firm, or compliance services environment.
  • Experience with GRC platforms such as Vanta, Drata, Secureframe, Hyperproof, AuditBoard, OneTrust, or similar tools.
  • Experience with additional frameworks such as HIPAA, HITRUST, NIST CSF, NIST 800-53, NIST 800-171, CMMC, PCI DSS, GDPR, CIS Controls, or privacy/security requirements for SaaS companies.
  • Experience advising startups, SaaS companies, technology companies, fintech companies, healthcare companies, or mid-market organizations.
  • Familiarity with AWS, Azure, Google Cloud, identity providers, endpoint security tools, vulnerability management tools, ticketing systems, and security monitoring platforms.
  • Relevant certifications such as CISA, CISSP, CRISC, CISM, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, Security+, or similar.

Ideal Candidate Profile
The ideal candidate is a strong consultant, manager, and security advisor. This person knows how to help clients make good security decisions without overwhelming them with unnecessary complexity.
  • You should be able to walk into a client environment, quickly understand their business, assess their compliance and security needs, and tell them what matters most. You should know how to guide clients through SOC 2, ISO 27001, and broader security program development in a way that is practical, credible, and aligned with the client's stage of growth.
  • You should also be a strong people manager. This role requires someone who can lead a team, review work, improve delivery quality, coach junior team members, and create repeatable consulting processes.
  • This is not just a documentation role or an audit coordination role. We are looking for someone who can act as a true vCISO: someone who can advise clients, manage risk, guide security strategy, lead a team, and help clients build security and compliance programs they can actually operate.

Compensation
The base salary for this role is $125,000 per year.
Additional compensation, benefits, bonus eligibility, and other incentives may be provided depending on company policy and candidate qualifications.
Work Location
This is an in-person role based in one of the following locations:
  • Richmond, Virginia

Candidates must be able to work in person from one of these locations and collaborate directly with clients, internal teams, auditors, and external stakeholders.
Benefits
We believe in rewarding hard work with meaningful perks that support your growth, health, and well-being.
  • 10 days of paid time off (PTO)
  • 11 paid federal holidays
  • 401(k) with 4% company match
  • Monthly healthcare stipend
  • Gym membership stipend
  • Weekly team lunches and in-office snacks

Apply