[Hiring] Risk Advisory GRC Consultant @Echelon Risk + Cyber

Role Description

At Echelon Risk + Cyber, we believe in defending the basic human right to security and privacy. We are looking for an exceptional Risk Advisory GRC Consultant to support the execution of Risk Advisory client engagements. This includes leading and executing relevant tasks, as well as assisting in developing service deliverables and internal processes that will drive value for the team and clients.

Our next team member will be authentic, articulate, and passionate about Cybersecurity, and will be unafraid to roll up their sleeves and dive deep into the unknowns, using their security expertise to identify opportunities to increase Echelon Risk + Cyber's overall capabilities internally and for our clients.

This is a remote position from anywhere in the USA.

What You Will Do:

• Perform SOC 2 Type I/II readiness assessments and support attestation engagements, including scoping, control evaluation, gap identification, and remediation guidance.
• Conduct ISO 27001 gap assessments, internal audits, and certification support engagements for clients across a range of industries and sizes.
• Test and evaluate IT General Controls (ITGCs) across client environments, documenting findings and providing actionable remediation recommendations.
• Support PCI DSS, HITRUST, HIPAA, and CMMC Level 2 compliance assessments as client workload requires.
• Prepare and review audit workpapers, evidence requests, control narratives, and client-facing deliverables to a consistent standard of quality.
• Work directly with clients to identify and assess information security risks, develop security policies and procedures, and provide practical remediation guidance.
• Contribute to incident response planning, tabletop exercises, and business continuity engagements as part of Echelon's broader advisory portfolio.
• Manage multiple concurrent client engagements, balancing priorities and delivering quality results on schedule.
• Build strong internal and client relationships through clear written and verbal communication, translating technical findings for both technical and non-technical audiences.
• Stay current with evolving compliance frameworks, audit standards, and security threats to strengthen client services and internal methodologies.
• Demonstrate thought leadership by creating content for the organization's website and blog, and through involvement in the cybersecurity community.

Qualifications

• 2–4 years of hands-on experience in IT audit, compliance, or GRC consulting, with a focus on SOC 2 Type I/II audits, ISO 27001 assessments, or related attestation engagements.
• Demonstrated understanding of IT General Controls (ITGCs), Trust Services Criteria, and audit standards such as SSAE 18 or ISAE 3402, with additional exposure to incident response planning and business continuity concepts.
• Ability to conduct risk assessments, compliance reviews, and readiness evaluations across frameworks, including SOC 2, ISO 27001, PCI DSS, HITRUST, and HIPAA.
• Strong analytical skills with the ability to identify and assess complex risk scenarios and offer practical solutions.
• Familiarity with leading GRC tools and technologies to support compliance and risk management initiatives.
• Excellent communication and presentation skills, capable of articulating technical concepts to technical and non-technical audiences.
• Strong project management skills, including managing multiple engagements and deliverables simultaneously while maintaining high quality and client satisfaction standards.
• Prior experience at a Big 4 firm, a mid-tier CPA/advisory firm, or a boutique IT audit/attestation firm is strongly preferred.

Preferred Qualifications

• Already certified in, or currently pursuing, one or more of the following: CISA, CIA, CPA, CISSP, and/or ISO 27001 Lead Auditor.
• Experience with the incident response lifecycle.
• Experience developing project plans and timelines.
• Track record of high-volume SOC 2 or ISO 27001 engagement delivery in a client-facing consulting or attestation role.
• Exposure to FedRAMP, CMMC, or other government compliance frameworks.

Benefits

• Access to medical, dental, and vision insurance through Cigna, with the majority of the employee cost covered by the employer.
• Employer funding to HSA accounts and FSA access.
• Access to a 401(k) through Vanguard with a guaranteed employer contribution.
• Flexible vacation policy that allows you to manage your schedule and rest and recharge when you need to.
• 11 holidays with flexibility based on what is important for you and those you love.
• Employer-paid short-term and long-term disability, employer-paid life insurance, and access to additional life insurance, hospital coverage, accidental coverage, discounted mental health support, and more.
• Support for individual development through certifications, continued learning, conferences, and more.

Company Description

Echelon Risk + Cyber is committed to creating an inclusive environment for our team with unquestioned integrity. We value a diverse workforce and a culture of inclusivity and belonging.

All employment decisions shall be made without regard to age, race, creed, color, religion, gender, national origin, ancestry, disability status, veteran status, sexual orientation, gender identity or expression, genetic information, marital status, citizenship status, or any other basis as protected by federal, state, or local law.

Echelon Risk + Cyber is an Equal Opportunity Employer.