[Hiring] AI GRC Consulting Partner @Near Shore Cyber

Role Description

We are recruiting senior AI GRC consultants for an initial six-month development programme and virtual delivery bench. This opportunity is intended for established security and GRC consultants who already have substantial client-delivery experience and demonstrable hands-on experience with AI. The programme develops and assesses the additional capabilities required to lead AI governance work. It is not an introductory cybersecurity or GRC course.

Selected candidates will complete structured learning, workshops, group projects, simulations, assessed work, and a capstone. Practitioners who demonstrate readiness may be considered for paid client engagements suited to their approved roles, availability, experience, and location.

Admission, participation, or graduation does not guarantee employment, certification, paid work, placement, or a minimum number of hours.

Work you may perform

• Lead AI governance and GRC engagements from discovery and scoping through assessment, roadmap development, implementation support, and executive reporting.
• Help clients establish AI governance models, decision rights, accountability, policies, risk tolerances, and review structures.
• Resolve conflicts among laws, regulations, contracts, policies, standards, risk tolerances, and operating requirements.
• Apply NIST AI RMF, ISO/IEC 42001, the EU AI Act, and related security, privacy, and assurance practices to actual AI systems and use cases.
• Assess AI inventories, system boundaries, data flows, model and provider dependencies, agents, tools, permissions, and human-oversight arrangements.
• Translate business and operational requirements into proportionate security, privacy, risk, and compliance controls.
• Assess control design and operating effectiveness, identify evidence gaps, and recommend remediation priorities.
• Develop risk, compliance, assurance, testing, and monitoring strategies.
• Advise executives and boards on material AI exposures, available options, residual risk, and the evidence supporting a recommendation.
• Lead third-party AI and model-provider assessments, including supply-chain, concentration, contractual, security, privacy, and operational risks.
• Evaluate certification readiness and support clients preparing for audits without misrepresenting advisory work as independent certification.
• Develop risk assessments, decision records, policies, control libraries, monitoring plans, remediation roadmaps, and executive reports.
• Establish and maintain effective communication among technical, legal, privacy, security, audit, risk, compliance, and business stakeholders.
• Mentor other consultants, review their work, and provide specific, evidence-based feedback.
• Help develop True Aleph methods, templates, quality standards, reusable artifacts, and professional guidance.
• Use approved AI tools responsibly while verifying material outputs and protecting client information.

Qualifications

• Ten or more years of professional experience in information technology or cybersecurity.
• At least five years of client-facing GRC consulting experience with demonstrable depth in risk, controls, compliance, audit, or assurance.
• Hands-on AI delivery experience in client, employer, or comparably accountable project settings.
• Experience implementing or operating security or compliance programmes.
• Experience leading engagements and communicating with executive stakeholders.
• Evidence that your recommendations have progressed beyond assessment into implementation, remediation, operation, or monitored production use.

Required framework and subject-matter fluency

• NIST AI RMF, including Govern, Map, Measure, and Manage.
• ISO/IEC 42001 management-system design and certification-readiness work.
• Integration of an AI management system with an existing ISO/IEC 27001 information security management system.
• The EU AI Act, including prohibited practices, risk classification, high-risk-system requirements, deployer obligations, technical documentation, transparency, human oversight, and post-market monitoring.
• NIST Cybersecurity Framework, NIST SP 800-53, ISO/IEC 27001 and 27002, SOC 2, and CIS Controls.
• Cybersecurity and privacy laws and regulations relevant to client engagements.
• AI-system and data lifecycles, model and agent concepts, common architectures, data flows, model limitations, and emerging operating patterns.
• AI security, including identity, access, prompt injection, data protection, third-party risk, secure development, testing, monitoring, and incident response.
• Supply-chain and model-provider risk.
• Risk assessment, control design, control testing, evidence evaluation, remediation planning, and assurance.
• Cognitive bias and its effect on risk analysis and executive decision-making.

Required skills

• Define a system boundary and identify the evidence needed to support a decision.
• Translate operational, legal, regulatory, and business requirements into implementable controls.
• Assess security and governance controls for design and operating effectiveness.
• Identify gaps in technical capability, evidence, accountability, and oversight.
• Develop practical remediation and monitoring plans.
• Evaluate vendor claims and technical documentation critically.
• Facilitate disagreements among technical, legal, security, privacy, and business stakeholders.
• Write concise findings, executive reports, decision records, and implementation guidance.
• Present recommendations to clients, executives, boards, auditors, and other reviewers.
• Lead delivery teams and review the work of other practitioners.
• Use AI assistants and GRC tooling without delegating professional accountability to the tool.
• Working-level technical literacy is required.

Required certifications

• ISACA Certified Information Systems Auditor (CISA).
• ISO/IEC 27001 Implementer or Lead Implementer credential.

Preferred qualifications

• IAPP Artificial Intelligence Governance Professional (AIGP).
• PCI Qualified Security Assessor (QSA).
• Project Management Professional (PMP).
• Experience with Vanta.
• Experience with an enterprise GRC platform such as ServiceNow GRC, Archer, LogicGate, or Drata.
• Experience evaluating or implementing an AI governance platform.
• Familiarity with model-risk, drift-monitoring, bias-testing, fairness, or explainability tools.
• Experience with Python, Microsoft Purview, or cloud AI platforms.
• Active participation in relevant professional associations.
• A record of speaking, teaching, publishing, or contributing to professional communities.
• Professional Spanish for cross-border engagements.

Language requirements

• Advanced professional English is required.
• Professional Spanish is strongly preferred for Mexico-facing engagements.

Programme commitment

• One facilitated two-hour workshop each week.
• Approximately 10–15 additional hours of independent and group work each week.
• Up to 20 hours during some capstone and simulation weeks.
• Participation in lectures, workshops, group projects, simulations, peer review, document production, and assessed exercises.
• Compliance with programme confidentiality, intellectual-property, data-handling, professional-conduct, and approved-tool requirements.
• The initial cohort carries no programme fee. Learning, simulation, and assessment activities are unpaid.

Selection process

• An application and eligibility review.
• The 200-question AI GRC Consultant assessment in Aramis:Insight.
• Interviews covering GRC depth, AI experience, consulting judgment, communication, and ability to meet the programme commitment.
• A final review based on the complete body of evidence.

Client engagements and compensation

• Commercial client work is paid under a separate written agreement.
• Rates are established for each opportunity based on the role, scope, delivery responsibility, risk, market, location, and contracting entity.
• Bench participation is non-exclusive. Consultants may pursue other work and may decline any opportunity.
• Graduates receive first consideration among comparably qualified practitioners for suitable engagements.