[Hiring] Senior Technical Consultant - Security GRC @Ahead

Role Description

This is a senior consulting role, not an internal control-operations seat. You will be sold to clients as a credible authority on security GRC. You diagnose program maturity, design target-state operating models, quantify risk in business terms, and leave behind frameworks, artifacts, and decisions the client can run without you.

• You must be highly proficient in English. Client deliverables, findings, board packs, statements of work, and live workshops are held to an executive and audit standard.
• You must be expert in:
  • NIST CSF
  • NIST SP 800-53
  • NIST SP 800-171
  • CIS Controls
  • Cyber Risk Institute (CRI) Profile
  • ISO/IEC 27001
• You must also be a consultant: structure ambiguous problems, manage senior stakeholders, run workshops, write commercial-quality deliverables, defend recommendations, and transfer capability to the client team.

Responsibilities

• Client consulting and engagement leadership
• Shape problem statements, engagement scope, assumptions, and success criteria with the client sponsor and the account team.
• Build workplans, RAID logs, and stakeholder maps; keep delivery on quality even when the client’s evidence or ownership is incomplete.
• Facilitate workshops with CISOs, control owners, internal audit, legal, procurement, and business executives. Drive decisions, not status meetings.
• Manage resistance, conflicting frameworks, and “we already have a policy” arguments without losing the room or the facts.
• Write and present deliverables that survive legal, audit, and executive review: current-state assessments, target operating models, control crosswalks, risk registers, quantified scenarios, roadmaps, and board narratives.
• Coach client staff so the program does not collapse when the engagement ends. Consulting value is transfer, not slide volume.
• Support pre-sales and scoping when asked: approach, level of effort, risks to delivery, and what “good” looks like for this client.

Framework design, assessment, and rationalization

• Assess and design against NIST CSF (1.1 and/or 2.0): profiles, subcategory outcomes, tiers, and CSF as the executive reporting spine.
• Assess and tailor NIST SP 800-53 (Rev. 5 preferred): control families, baselines, overlays, common/hybrid/system-specific controls, and assessment procedures.
• Assess NIST SP 800-171 implementation for CUI: requirement status, 800-171A-style objectives, scoping of CUI flows, POA&Ms, and contractor obligation implications.
• Apply CIS Controls (v8 preferred) as a prioritized operational control set (IG1–IG3), mapped to CSF and 800-53 rather than run as a second bureaucracy.
• Interpret and assess the CRI Profile, including diagnostic statements and financial-sector or critical-third-party expectations.
• Design or uplift an ISO/IEC 27001 ISMS: scope, SoA, risk assessment and treatment, internal audit liaison, management review inputs, and certification or surveillance readiness.
• Build and maintain crosswalks so one control, one owner, and one evidence package can satisfy multiple frameworks.

Assurance, evidence, and defensible writing

• Design test procedures, challenge evidence quality, and write deficiency and residual-risk narratives that are factual and unambiguous.
• Prepare clients for internal audit, ISO certification bodies, customer assessments, and 800-171 / CRI / CSF inquiries.
• Produce executive summaries that a non-specialist leader can act on without a decoder.

Qualifications

• Highly proficient written and spoken English at an executive, audit, and client-delivery standard.
• Demonstrated senior consulting or equivalent client-advisory experience.
• Frameworks (all required, with working depth—not acronym familiarity):
  • NIST Cybersecurity Framework
  • NIST SP 800-53
  • NIST SP 800-171
  • CIS Controls
  • CRI Profile
  • ISO/IEC 27001 (working command of 27002 expected)
• End-to-end risk management and risk quantification.

Experience and education

• Roughly 5+ years in security GRC, risk, audit, or control assurance.
• Bachelor’s degree in a relevant field or equivalent experience.

Benefits

• Comprehensive health insurance coverage for employees, with options to extend coverage to dependents.
• Paid time off and company holidays, along with additional leave benefits as per policy.
• Flexible work arrangements, supporting work-life balance.
• Learning and development opportunities to support continuous growth and upskilling.
• Employee wellness initiatives and programs focused on physical and mental well-being.
• Retirement and statutory benefits in line with India regulations.
• Inclusive and people-first culture, with a strong focus on collaboration and ownership.