{"id":1269747,"url":"https://alion.io/job/sisa-cybersecurity-grc-consultant","title":"Cybersecurity GRC Consultant","company":{"id":2144267,"name":"SISA","domain":"sisa.ai","url":"https://alion.io/company/sisa-ai","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Keka","truth_index":{"grade":"B","score":75,"open_postings":9,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-12T06:55:09Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Mumbai, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":1200000,"max":1800000,"currency":"INR","period":"year","gross":null,"usd_annual":18581},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"FedRAMP","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST CSF","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-09-15T11:29:01Z","employer_posted_date":"2026-09-15","last_verified_at":"2026-10-12T20:03:34Z","board_verified":true,"closed_at":null,"days_open":27,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":27},"description":"Cybersecurity GRC Consultant - CMMC, FedRAMP & Security Compliance\nRole Overview\nWe are looking for a hands-on Cybersecurity GRC Consultant with strong experience in CMMC, FedRAMP, NIST, SOC 2, ISO 27001 and/or HITRUST to lead and deliver cybersecurity compliance and advisory engagements.\nThe role requires practical experience in control assessment, framework mapping, evidence validation, gap assessment, risk analysis, remediation advisory and audit/report delivery. The ideal candidate should be comfortable working directly with clients, understanding their technology and business environment, translating requirements into actionable controls, and managing engagements from scoping through final deliverables.\nThis is a delivery-focused consulting role requiring both technical understanding and strong client-facing capabilities.\nKey Responsibilities\nLead end-to-end cybersecurity GRC and compliance engagements, including scoping, planning, assessment, evidence review, gap analysis, remediation support and final reporting.\nPerform assessments against CMMC 2.0, FedRAMP, NIST SP 800-171, NIST SP 800-53, ISO 27001, SOC 2 and HITRUST CSF, based on client requirements.\nDevelop and maintain control mappings and crosswalks across CMMC, FedRAMP, NIST, ISO 27001, SOC 2 and HITRUST.\nConduct detailed control design and operating effectiveness assessments, including review of policies, procedures, configurations, records and other audit evidence.\nEvaluate control gaps, determine risk and impact, and develop practical remediation recommendations.\nSupport clients in defining and documenting security controls, policies, procedures, control narratives and evidence requirements.\nDevelop and/or review System Security Plans (SSPs), Plans of Action & Milestones (POA&Ms), risk assessments, Statements of Applicability, control matrices and audit workpapers.\nSupport SOC 2 readiness and Type I/Type II assessment activities, including Trust Services Criteria mapping, control testing and evidence evaluation.\nSupport ISO 27001 implementation/readiness/certification and surveillance activities, including ISMS controls, risk treatment and Statement of Applicability.\nSupport HITRUST CSF readiness and validated assessment activities, including control mapping, evidence assessment and remediation tracking.\nPerform NIST-based cybersecurity assessments using NIST CSF and NIST SP 800-series standards where applicable.\nValidate control mappings and assessment methodologies against applicable regulatory, industry and framework requirements.\nLead client discussions with IT, security, engineering, compliance, risk and audit stakeholders to understand the environment and validate controls.\nPrepare assessment reports, findings, risk ratings, executive summaries and remediation roadmaps for technical and executive audiences.\nCoordinate with external assessors, auditors, C3PAOs/3PAOs and other assurance stakeholders where applicable.\nMaintain assessment quality through structured workpapers, evidence traceability, review procedures and quality assurance.\nContribute to development and continuous improvement of GRC methodologies, assessment templates, control libraries and reusable delivery assets.\nSupport presales activities, including scope definition, effort estimation, solutioning and technical proposal inputs.\nRequired Qualifications\n5+ years of hands-on experience in cybersecurity GRC, IT audit, security compliance or risk consulting.\nDemonstrated experience delivering one or more of the following:CMMC 2.0\nFedRAMP\nNIST CSF / NIST SP 800-171 / NIST SP 800-53\nISO 27001\nSOC 2\nHITRUST CSF\n\nStrong understanding of security control frameworks, control objectives, control design, operating effectiveness and evidence-based assessment methodologies.\nHands-on experience with control mapping/crosswalks across multiple cybersecurity and compliance frameworks.\nExperience conducting gap assessments, risk assessments, control testing and evidence validation.\nExperience preparing or reviewing SSPs, POA&Ms, risk registers, control matrices, audit workpapers and assessment reports.\nPractical understanding of cloud security, IAM, network security, vulnerability management, logging/monitoring, incident response, data protection, business continuity and third-party risk.\nAbility to translate technical and regulatory requirements into practical security controls and implementation recommendations.\nStrong written and verbal communication skills with the ability to communicate effectively with both technical teams and senior management.\nAbility to work independently in a consulting environment and manage multiple client engagements.\nPreferred Qualifications\nCertifications in one or more of the following are preferred:\nCMMC-AB Certified CMMC Professional (CCP) / Certified CMMC Assessor (CCA)\nFedRAMP / 3PAO assessment experience\nCISSP\nCISA\nCISM\nCRISC\nISO 27001 Lead Auditor / Lead Implementer\nHITRUST Certified CSF Practitioner / related HITRUST credential\nSOC 2 / AICPA-related audit or assurance experience","description_format":"text","description_chars":5031,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Artificial Intelligence"],"lifecycle":[{"event":"open","at":"2026-09-25T23:37:36Z"}],"visa":[],"liveness":{"score":59,"band":"ok","label":"Likely open","p_open":1,"p_active":0.79,"p_room":0.75,"age_days":26,"expected_fill_days":37,"reasons":["conf:3","velocity","win:late"],"computed_at":"2026-10-12T06:55:09Z"},"pay":{"stated_usd_annual":18581,"is_top_pay":false},"html_url":"https://alion.io/job/sisa-cybersecurity-grc-consultant","json_url":"https://alion.io/job/sisa-cybersecurity-grc-consultant.json","meta":{"generated_at":"2026-10-12T20:41:09Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":33571,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2144267},"rest":"https://alion.io/mcp/rest/get_company?id=2144267"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsisa-cybersecurity-grc-consultant"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsisa-cybersecurity-grc-consultant"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsisa-cybersecurity-grc-consultant"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sisa-cybersecurity-grc-consultant\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsisa-cybersecurity-grc-consultant"}]}