Trace3 - Architect | GRC/AI Governance (Remote)

• Bachelor’s degree in Information Systems, Cybersecurity, or a related field, or equivalent professional experience • Minimum of 8 years’ experience in information security, IT risk, or IT audit, including at least 5 years delivering GRC consulting or assessment engagements • CISSP, CISA, CISM, CRISC, or equivalent security or risk certification strongly desired • Demonstrated experience leading NIST CSF assessments, from planning and stakeholder interviews through maturity scoring, roadmap development, and executive readout • Strong expertise in assessing the maturity of security programs to identify current state and establish a roadmap to a defined target state that accounts for capability gaps and associated risks • Extensive knowledge of industry security and risk management frameworks (e.g., NIST CSF, NIST SP 800-53, ISO 27001, ISO 27005, NIST RMF) and hands-on experience assessing against them • Experience performing IT/IS risk, privacy, and control assessments based on leading practice and regulatory requirements (e.g., PCI DSS, SOC 2, HIPAA, GDPR) • Excellent written communication skills with the ability to produce clear, client-ready deliverables • Excellent oral communication and presentation skills, with the ability to present findings to C-level executives and non-technical audiences • Highly organized, detail-oriented, excellent time management skills, and able to effectively prioritize tasks in a fast-paced, high-volume, and evolving work environment • Ability to manage multiple concurrent engagements and changing priorities while meeting deadlines • Ability to approach client requests in a proactive and consultative manner; listen, understand client needs, and effectively deliver • Motivated self-starter who loves to solve challenging problems and feels comfortable working directly with clients • Ability to travel when needed • Experience conducting Business Impact Analyses and supporting business continuity and disaster recovery programs (e.g., ISO 22301, NIST SP 800-34) • Experience with AI governance frameworks and regulations, such as the NIST AI RMF, ISO/IEC 42001, the EU AI Act, and U.S. state AI legislation • Relevant certifications such as CBCP, ISO 27001 Lead Auditor or Lead Implementer, ISO/IEC 42001 Lead Implementer or Lead Auditor, IAPP AIGP, or CIPP • Experience with GRC platforms (e.g., ServiceNow IRM, Archer, OneTrust) • Experience serving clients in regulated industries such as financial services, healthcare, or the public sector • Prior professional services or Big 4 consulting experience • Actual salary will be based on a variety of factors, including location, experience, skill set, performance, licensure and certification, and business needs. The range for this position in other geographic locations may differ. Certain positions may also be eligible for variable incentive compensation, such as bonuses or commissions, that is not included in the base salary.