[Hiring] Senior GRC Consultant @Sprinto

Role Description

Owns day-to-day GRC program maturity and delivery for Sprinto's standard-framework services — the highest-volume, highest-repeatability engine of Trust Assurance. Keeps the standard-framework playbook current, delivers consistently, and is the internal go-to for ISO 27001 / SOC 2 / GDPR / PCI DSS etc. maturity questions across Sales, SE, and CS.

• Deliver:
  • Own delivery for standard-framework engagements: ISO 27001 (implementation & surveillance), SOC 2 Type I/II readiness, GDPR, PCI DSS compliance programs, gap assessments, control/check mapping, internal audits, policy reviews, audit readiness support.
  • Run multiple concurrent client engagements to a consistent quality bar without close supervision.
• Build reusable IP:
  • Maintain and evolve templates, control-mapping libraries, workshop agendas, and QA rubrics for standard frameworks; keep them current as frameworks revise (ISO 27001:2022 transition-type updates, SOC 2 trust criteria changes, GDPR enforcement guidance).
  • Extend the library opportunistically to adjacent frameworks (HIPAA, PCI DSS, ISO 42001) as demand grows.
• Own commercial outcomes:
  • Define pricing/packaging for standard-framework engagements (fixed-fee tiers, retainer options).
  • Own utilization, margin, and delivery forecasting for your own engagement book.
  • Partner with Sales/SE/CS to attach and renew standard-framework services; support deal conversion where technical validation is needed.
• AI-enabled productization:
  • Build and maintain AI-assisted playbooks for standard frameworks (gap assessment, control mapping, internal audit checklists).
  • Define structured input forms/checklists so juniors or AI-assisted workflows produce consistent first-draft output.
  • Set QA guardrails: mandatory source inputs, validation steps, human approval gates.
• Quality & risk:
  • Establish acceptance criteria and review checkpoints for deliverables.
  • Flag scope creep early; escalate ambiguous liability questions rather than absorbing them silently.

Qualifications

• 5+ years in GRC/security consulting or in-house compliance program ownership.
• Hands-on delivery track record across ISO 27001, SOC 2, and GDPR at minimum.
• Comfortable running several concurrent client engagements.
• Deep domain mastery in ISO 27001, SOC 2 Type I/II, GDPR.
• Working knowledge (nice to have): PCI DSS, HIPAA, ISO 42001 etc.
• Demonstrated use of AI tools to reduce manual effort and standardize deliverables.
• Strong written communication; confident running client workshops solo.
• Good judgment in ambiguity, without scope creep.

Requirements

• ISO 27001 LA/LI, CISA, or CISM preferred.
• This is a contract role for six months & we are looking for candidates who can join us immediately.

Success Metrics

• Utilization % and gross margin on standard-framework engagements.
• QA pass rate, rework rate, deliverable cycle time (benchmarked against standard-framework norms — weeks, not months).
• Customer satisfaction (CSAT) on delivered engagements.
• Attach rate for standard-framework services; playbook reuse rate.

Inclusion & Diversity

At Sprinto, talent, curiosity, and ownership matter more than where you come from. We hire people for the problems they can solve, the impact they create, and the way they help others succeed—not their background, identity, or personal circumstances. We believe the best teams are built when people with different perspectives come together around a shared ambition to build something meaningful.

We're proud to be an equal opportunity employer and are committed to creating a fair, inclusive, and accessible hiring process for everyone.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.