Architect – GRC/AI Governance

Trace3

. Lead and execute GRC engagements end-to-end, including kickoff, stakeholder interviews, documentation and evidence review, analysis, deliverable development, and executive readouts .

Posted 11/4/2026full-timeRemote • Texas • United StatesSeniorLead💰 $135,000 - $163,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in leading GRC engagements, performing security program maturity assessments, and conducting risk assessments against various regulatory frameworks. Proficient in developing tailored governance models, policies, and strategic roadmaps while effectively communicating findings to stakeholders.

Highest-signal resume keywords

GRC Engagement LeadershipNIST CSF AssessmentRisk Assessment and ManagementSecurity Program Maturity AssessmentRegulatory Compliance Expertise

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

NIST CSF 2.0NIST SP 800-53ISO 27001PCI DSSHIPAASOC 2CMMCGDPRBusiness Impact AnalysisRisk Register Development

Soft Skills

Excellent Written CommunicationExcellent Oral CommunicationHighly OrganizedDetail-OrientedProactive Client Engagement

Tools & Technologies

ServiceNow IRMArcherOneTrust

Certifications & Qualifications

CISSPCISACISMCRISCCBCPISO 27001 Lead AuditorISO/IEC 42001 Lead ImplementerIAPP AIGPCIPP

Industry Keywords

Information SecurityIT RiskIT AuditCybersecurityRegulated Industries

Tech Stack

Tools & technologies

Cyber SecurityServiceNow

About the role

Key responsibilities & impact

Lead and execute GRC engagements end-to-end, including kickoff, stakeholder interviews, documentation and evidence review, analysis, deliverable development, and executive readouts
Perform security program maturity assessments against NIST CSF 2.0, NIST SP 800-53, ISO 27001, and CIS Critical Security Controls
Conduct gap and readiness assessments against PCI DSS, HIPAA, SOC 2, GLBA, FFIEC, SOX, CMMC, and GDPR
Perform IT and cyber risk assessments, including risk identification, analysis, and rating, and develop risk registers and risk treatment plans
Conduct Business Impact Analyses to identify critical processes, dependencies, supporting technology, and recovery objectives
Assess and help establish AI governance programs, including AI use-case inventories, acceptable use policies, AI risk assessments, and alignment with NIST AI RMF, ISO/IEC 42001, and the EU AI Act
Facilitate client workshops and interviews with executive stakeholders, process owners, and technical teams
Assess current-state capabilities and define target states, priorities, dependencies, and implementation roadmaps
Translate regulatory, security, and AI requirements into tailored controls, governance models, policies, procedures, standards, and measurable objectives
Develop and quality-review assessment reports, gap analyses, maturity scorecards, risk registers, control mappings, BIA reports, executive briefings, and strategic roadmaps
Manage engagement schedules, status reporting, client communication, and escalation of scope or timeline risks
Mentor consultants and provide technical quality review of their work
Contribute to delivery methodologies, assessment tools, templates, and reusable intellectual property
Maintain current knowledge of evolving frameworks, regulations, and industry trends and share lessons learned

Requirements

What you’ll need

Bachelor’s degree in Information Systems, Cybersecurity, or a related field, or equivalent professional experience
Minimum of 8 years’ experience in information security, IT risk, or IT audit, including at least 5 years delivering GRC consulting or assessment engagements
Demonstrated experience leading NIST CSF assessments, from planning and stakeholder interviews through maturity scoring, roadmap development, and executive readout
Strong expertise in assessing the maturity of security programs to identify current state and establish a roadmap to a defined target state that accounts for capability gaps and associated risks
Extensive knowledge of industry security and risk management frameworks, including NIST CSF, NIST SP 800-53, ISO 27001, ISO 27005, and NIST RMF, and hands-on experience assessing against them
Experience performing IT/IS risk, privacy, and control assessments based on leading practice and regulatory requirements, including PCI DSS, SOC 2, HIPAA, and GDPR
Excellent written communication skills with the ability to produce clear, client-ready deliverables
Excellent oral communication and presentation skills, with the ability to present findings to C-level executives and non-technical audiences
Highly organized, detail-oriented, excellent time management skills, and able to effectively prioritize tasks in a fast-paced, high-volume, and evolving work environment
Ability to manage multiple concurrent engagements and changing priorities while meeting deadlines
Ability to approach client requests in a proactive and consultative manner; listen, understand client needs, and effectively deliver
Motivated self-starter who loves to solve challenging problems and feels comfortable working directly with clients
Ability to travel when needed
CISSP, CISA, CISM, CRISC, or equivalent security or risk certification strongly desired
Experience conducting Business Impact Analyses and supporting business continuity and disaster recovery programs preferred
Experience with AI governance frameworks and regulations preferred
Relevant certifications such as CBCP, ISO 27001 Lead Auditor or Lead Implementer, ISO/IEC 42001 Lead Implementer or Lead Auditor, IAPP AIGP, or CIPP preferred
Experience with GRC platforms such as ServiceNow IRM, Archer, or OneTrust preferred
Experience serving clients in regulated industries preferred
Prior professional services or Big 4 consulting experience preferred

Benefits

Comp & perks

Comprehensive medical, dental and vision plans for you and your dependents
401(k) Retirement Plan with Employer Match
529 College Savings Plan
Health Savings Account
Life Insurance
Long-Term Disability
Competitive Compensation
Training and development programs
Major offices stocked with snacks and beverages
Collaborative and cool culture
Work-life balance and generous paid time off