Cybersecurity GRC Consultant

Cybersecurity GRC Consultant – CMMC, FedRAMP & Security Compliance Role Overview We are looking for a hands-on Cybersecurity GRC Consultant with strong experience in CMMC, FedRAMP, NIST, SOC 2, ISO 27001 and/or HITRUST to lead and deliver cybersecurity compliance and advisory engagements. The role requires practical experience in control assessment, framework mapping, evidence validation, gap assessment, risk analysis, remediation advisory and audit/report delivery. The ideal candidate should be comfortable working directly with clients, understanding their technology and business environment, translating requirements into actionable controls, and managing engagements from scoping through final deliverables. This is a delivery-focused consulting role requiring both technical understanding and strong client-facing capabilities. Key Responsibilities Lead end-to-end cybersecurity GRC and compliance engagements, including scoping, planning, assessment, evidence review, gap analysis, remediation support and final reporting. Perform assessments against CMMC 2.0, FedRAMP, NIST SP 800-171, NIST SP 800-53, ISO 27001, SOC 2 and HITRUST CSF, based on client requirements. Develop and maintain control mappings and crosswalks across CMMC, FedRAMP, NIST, ISO 27001, SOC 2 and HITRUST. Conduct detailed control design and operating effectiveness assessments, including review of policies, procedures, configurations, records and other audit evidence. Evaluate control gaps, determine risk and impact, and develop practical remediation recommendations. Support clients in defining and documenting security controls, policies, procedures, control narratives and evidence requirements. Develop and/or review System Security Plans (SSPs), Plans of Action & Milestones (POA&Ms), risk assessments, Statements of Applicability, control matrices and audit workpapers. Support SOC 2 readiness and Type I/Type II assessment activities, including Trust Services Criteria mapping, control testing and evidence evaluation. Support ISO 27001 implementation/readiness/certification and surveillance activities, including ISMS controls, risk treatment and Statement of Applicability. Support HITRUST CSF readiness and validated assessment activities, including control mapping, evidence assessment and remediation tracking. Perform NIST-based cybersecurity assessments using NIST CSF and NIST SP 800-series standards where applicable. Validate control mappings and assessment methodologies against applicable regulatory, industry and framework requirements. Lead client discussions with IT, security, engineering, compliance, risk and audit stakeholders to understand the environment and validate controls. Prepare assessment reports, findings, risk ratings, executive summaries and remediation roadmaps for technical and executive audiences. Coordinate with external assessors, auditors, C3PAOs/3PAOs and other assurance stakeholders where applicable. Maintain assessment quality through…