{"id":1227911,"url":"https://alion.io/job/sisainfosec-cyber-security-consultant","title":"Cyber Security Consultant - GRC Tools","company":{"id":2278839,"name":"SISA Infosec","domain":"sisainfosec.com","url":"https://alion.io/company/sisainfosec","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Mumbai, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":18500,"max_usd":39000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":11},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"FedRAMP","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST CSF","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-09-22T11:52:11Z","employer_posted_date":null,"last_verified_at":"2026-09-22T11:52:11Z","board_verified":false,"closed_at":null,"days_open":30,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":30},"description":"Cybersecurity GRC Consultant - CMMC, FedRAMP & Security Compliance.\n\nRole Overview :\n\nWe are looking for a hands-on Cybersecurity GRC Consultant with strong experience in CMMC, FedRAMP, NIST, SOC 2, ISO 27001 and/or HITRUST to lead and deliver cybersecurity compliance and advisory engagements.\n\nThe role requires practical experience in control assessment, framework mapping, evidence validation, gap assessment, risk analysis, remediation advisory and audit/report delivery.\n\nThis is a delivery-focused consulting role requiring both technical understanding and strong client-facing capabilities.\n\nKey Responsibilities :\n\n- Lead end-to-end cybersecurity GRC and compliance engagements, including scoping, planning, assessment, evidence review, gap analysis, remediation support and final reporting.\n\n- Perform assessments against CMMC 2.0, FedRAMP, NIST SP 800-171, NIST SP 800-53, ISO 27001, SOC 2 and HITRUST CSF, based on client requirements.\n\n- Develop and maintain control mappings and crosswalks across CMMC, FedRAMP, NIST, ISO 27001, SOC 2 and HITRUST.\n\n- Conduct detailed control design and operating effectiveness assessments, including review of policies, procedures, configurations, records and other audit evidence.\n\n- Evaluate control gaps, determine risk and impact, and develop practical remediation recommendations.\n\n- Support clients in defining and documenting security controls, policies, procedures, control narratives and evidence requirements.\n\n- Develop and/or review System Security Plans (SSPs), Plans of Action & Milestones (POA&Ms), risk assessments, Statements of Applicability, control matrices and audit workpapers.\n\n- Support SOC 2 readiness and Type I/Type II assessment activities, including Trust Services Criteria mapping, control testing and evidence evaluation.\n\n- Support ISO 27001 implementation/readiness/certification and surveillance activities, including ISMS controls, risk treatment and Statement of Applicability.\n\n- Support HITRUST CSF readiness and validated assessment activities, including control mapping, evidence assessment and remediation tracking.\n\n- Perform NIST-based cybersecurity assessments using NIST CSF and NIST SP 800-series standards where applicable.\n\n- Validate control mappings and assessment methodologies against applicable regulatory, industry and framework requirements.\n\n- Lead client discussions with IT, security, engineering, compliance, risk and audit stakeholders to understand the environment and validate controls.\n\n- Prepare assessment reports, findings, risk ratings, executive summaries and remediation roadmaps for technical and executive audiences.\n\n- Coordinate with external assessors, auditors, C3PAOs/3PAOs and other assurance stakeholders where applicable.\n\n- Maintain assessment quality through structured workpapers, evidence traceability, review procedures and quality assurance.\n\n- Contribute to development and continuous improvement of GRC methodologies, assessment templates, control libraries and reusable delivery assets.\n\n- Support presales activities, including scope definition, effort estimation, solutioning and technical proposal inputs.\n\nRequired Qualifications :\n\n- 5+ years of hands-on experience in cybersecurity GRC, IT audit, security compliance or risk consulting.\n\n- Demonstrated experience delivering one or more of the following: CMMC 2.0, FedRAMP, NIST CSF / NIST SP 800-171 / NIST SP 800-53, ISO 27001, SOC 2, HITRUST CSF.\n\n- Strong understanding of security control frameworks, control objectives, control design, operating effectiveness and evidence-based assessment methodologies.\n\n- Hands-on experience with control mapping/crosswalks across multiple cybersecurity and compliance frameworks.\n\n- Experience conducting gap assessments, risk assessments, control testing and evidence validation.\n\n- Experience preparing or reviewing SSPs, POA&Ms, risk registers, control matrices, audit workpapers and assessment reports.\n\n- Practical understanding of cloud security, IAM, network security, vulnerability management, logging/monitoring, incident response, data protection, business continuity and third-party risk.\n\n- Ability to translate technical and regulatory requirements into practical security controls and implementation recommendations.\n\n- Strong written and verbal communication skills with the ability to communicate effectively with both technical teams and senior management.\n\n- Ability to work independently in a consulting environment and manage multiple client engagements.\n\nPreferred Qualifications :\n\n- Certifications in one or more of the following are preferred : CMMC-AB Certified CMMC Professional (CCP) / Certified CMMC Assessor (CCA), FedRAMP / 3PAO assessment experience, CISSP, CISA, CISM, CRISC, ISO 27001 Lead Auditor / Lead Implementer, HITRUST Certified CSF Practitioner / related HITRUST credential, SOC 2 / AICPA-related audit or assurance experience.\n\nSkills\nCISSP, CISA, CISM, Information Security, IT Audit, SOC II, GRC, GRC Tools, Security Protocols","description_format":"text","description_chars":5005,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Penetration Testing","Security Compliance"],"lifecycle":[{"event":"open","at":"2026-09-25T13:06:44Z"}],"visa":[],"liveness":{"score":24,"band":"cold","label":"Long shot","p_open":0.6,"p_active":0.727,"p_room":0.55,"age_days":30,"expected_fill_days":27,"reasons":["seen:30","win:tail"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/sisainfosec-cyber-security-consultant","json_url":"https://alion.io/job/sisainfosec-cyber-security-consultant.json","meta":{"generated_at":"2026-10-23T08:48:42Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14180,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2278839},"rest":"https://alion.io/mcp/rest/get_company?id=2278839"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsisainfosec-cyber-security-consultant"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsisainfosec-cyber-security-consultant"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsisainfosec-cyber-security-consultant"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sisainfosec-cyber-security-consultant\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsisainfosec-cyber-security-consultant"}]}