[Hiring] Security Solutions Consultant - Cyber Risk and Strategy @World Wide Technology

Role Description

The Cyber Risk and Strategy Consultant is an individual contributor who executes assigned delivery tasks within WWT’s Governance, Risk, Strategy and Compliance practice. Positioned below the Senior Consultant, the Consultant builds practical knowledge across GRC domains, contributes to high quality client deliverables under the guidance of experienced team members, and develops the core consulting skills needed to grow within the practice.

The Consultant is a core contributor to GRC delivery, supporting risk assessments and compliance gap analyses, gathering and organizing evidence, reviewing policies and controls, and producing the documentation and analysis that inform client recommendations. They work under the direction of a Senior Consultant, Lead Consultant, or Senior Manager, and are expected to grow steadily toward greater independence and ownership of defined workstream components.

Qualifications

• 2 to 4 years of experience in cybersecurity, IT risk, IT audit, or compliance, with practical exposure to at least one GRC domain (risk management, compliance program management, policy governance, or third party risk)
• Experience supporting GRC work in one or more of the following areas:
  • Risk Management: IT risk assessment support, risk register maintenance, qualitative risk scoring, and risk treatment tracking
  • Compliance Program Management: gap assessment support, controls mapping, audit readiness activities, evidence collection, and remediation tracking against frameworks such as SOC 2, ISO 27001, HIPAA, PCI DSS, or SOX ITGC
  • Policy & Control Governance: policy review and update cycles, mapping controls to frameworks (NIST, CIS, ISO), control testing support, and policy exception tracking
  • Third Party & Vendor Risk: vendor assessment questionnaire administration, review of vendor responses and evidence, risk tiering support, and remediation tracking
  • GRC Platforms: ServiceNow GRC, Archer, OneTrust, Vanta, Drata, or equivalent, as an end user or administrator maintaining records, running assessments, or building reports
• Foundational knowledge of common GRC and security frameworks, such as NIST CSF 2.0, NIST SP 800-53, ISO 27001/27002, CIS Controls v8, SOC 2 Trust Services Criteria, PCI DSS v4, HIPAA Security Rule, and SOX ITGC
• Understanding of core GRC concepts: risk identification and scoring, control design vs. control effectiveness, separation of duties, three lines of defense, the audit lifecycle, and data privacy principles
• Strong proficiency with Microsoft Excel, PowerPoint, and Word
• Foundational consulting delivery competencies, including:
  • Structured discovery: ability to support discovery interviews, take thorough notes, gather documentation and evidence, and organize information into clear, structured outputs
  • Gap analysis: ability to compare documented controls and practices against framework requirements and clearly document gaps for team review
  • Technical communication: ability to draft clear, accurate written findings and summaries, and to communicate status and questions concisely to the engagement team and client counterparts
  • Workshop support: participate in discovery sessions, risk workshops, and working group meetings; help prepare materials and capture decisions and action items
  • Deliverable quality: strong attention to detail and a track record of producing accurate, clearly organized work products on time and to standard
  • Engagement collaboration: work effectively within project teams; communicate progress and blockers proactively to the engagement lead; adapt to shifting priorities and client needs

Requirements

• Bachelor’s degree in Information Security, Risk Management, Business, or a related field (preferred)
• Industry certifications demonstrating security or GRC knowledge, such as Security+, ISC2 CC, SSCP, GRCP, or equivalent; progress toward CISA, CRISC, CISM, or CISSP is a plus, as are platform certifications from ServiceNow, OneTrust, or Archer
• Exposure to enterprise environments in financial services, healthcare, retail, manufacturing, or public sector, particularly where compliance is shaped by regulatory requirements (SOX, HIPAA, PCI DSS, DORA, FedRAMP)
• Prior experience at a professional services firm, audit firm, or systems integrator, or within an internal audit or compliance function
• Familiarity with additional frameworks and methods such as NIST RMF, COBIT, FedRAMP, DORA, or FAIR risk quantification

Benefits

• Health and Wellbeing: Health (Medical & Prescription), Dental, and Vision Care, Onsite Health Centers (MO & IL), Employee Assistance Program, Wellness program
• Financial Benefits: Competitive Pay, Profit Sharing, 401k Plan with Company Matching, Life and Disability Insurance, Flexible Spending Accounts, Tuition Reimbursement
• Paid Time Off: PTO & Holidays, Parental Leave, Medical Leave, Military Leave, Bereavement, Day of Caring
• Additional Perks: Family Planning Benefits, Nursing Mothers Benefits, Voluntary Legal, Voluntary Supplemental Accident/Illness/Hospital, Voluntary ID Theft, Pet Insurance, Employee Discount Program