Architect | GRC/AI Governance (Remote)

Trace3•Dallas, TX

3d•Remote

About The Position

The Architect, Governance, Risk & Compliance (GRC) is a senior, delivery-focused consultant who leads and executes GRC engagements for Trace3 clients. The role performs framework-based security program assessments, risk assessments, and business impact analyses, then translates findings into practical, prioritized roadmaps to help clients build resilient, scalable, and compliant security programs. The Architect works with CISOs, risk and compliance leaders, control owners, and technical teams from engagement kickoff through executive readout, and helps clients establish governance over artificial intelligence use in alignment with emerging frameworks, regulations, and internal risk tolerance. The role is accountable for engagement quality, timely deliverables, and client satisfaction, and builds trusted client relationships to enable client success. Trace3 is a technology solutions and consulting services company headquartered in Irvine, California, with more than 1,200 employees across the United States. Its culture emphasizes innovation, adaptability, results, teamwork, respect, and inclusive collaboration. The estimated base salary range is $135,000–$163,000 USD. Actual salary may vary based on location, experience, skill set, performance, licensure and certifications, and business needs. Certain positions may also be eligible for variable incentive compensation, such as bonuses or commissions, not included in base salary. The role is remote, and travel may be needed.

Requirements

Bachelor’s degree in Information Systems, Cybersecurity, or a related field, or equivalent professional experience.
At least 8 years of experience in information security, IT risk, or IT audit, including at least 5 years delivering GRC consulting or assessment engagements.
Demonstrated experience leading NIST CSF assessments from planning and stakeholder interviews through maturity scoring, roadmap development, and executive readout.
Strong expertise assessing security-program maturity, identifying current state, and establishing a roadmap to a defined target state that accounts for capability gaps and associated risks.
Extensive knowledge of security and risk management frameworks, such as NIST CSF, NIST SP 800-53, ISO 27001, ISO 27005, and NIST RMF, and hands-on experience assessing against them.
Experience performing IT/IS risk, privacy, and control assessments based on leading practice and regulatory requirements, such as PCI DSS, SOC 2, HIPAA, and GDPR.
Excellent written communication skills and ability to produce clear, client-ready deliverables.
Excellent oral communication and presentation skills, including presenting findings to C-level executives and non-technical audiences.
Highly organized and detail-oriented, with strong time-management skills and ability to prioritize in a fast-paced, high-volume, evolving environment.
Ability to manage multiple concurrent engagements and changing priorities while meeting deadlines.
Proactive, consultative approach to client requests; ability to listen, understand client needs, and deliver effectively.
Self-starter motivated to solve challenging problems and work directly with clients.
Ability to travel when needed.

Nice To Haves

CISSP, CISA, CISM, CRISC, or equivalent security or risk certification.
Experience conducting Business Impact Analyses and supporting business continuity and disaster recovery programs, such as ISO 22301 or NIST SP 800-34.
Experience with AI governance frameworks and regulations, such as the NIST AI RMF, ISO/IEC 42001, the EU AI Act, and U.S. state AI legislation.
Certifications such as CBCP, ISO 27001 Lead Auditor or Lead Implementer, ISO/IEC 42001 Lead Implementer or Lead Auditor, IAPP AIGP, or CIPP.
Experience with GRC platforms such as ServiceNow IRM, Archer, or OneTrust.
Experience serving regulated-industry clients, such as financial services, healthcare, or the public sector.
Prior professional services or Big 4 consulting experience.

Responsibilities

Lead and execute GRC engagements end to end, including kickoff, stakeholder interviews, documentation and evidence review, analysis, deliverable development, and executive readouts.
Perform security program maturity assessments against the NIST Cybersecurity Framework (CSF 2.0) and related frameworks, including NIST SP 800-53, ISO 27001, and CIS Critical Security Controls as appropriate.
Conduct gap and readiness assessments against regulatory and compliance requirements, including PCI DSS, HIPAA, SOC 2, GLBA, FFIEC, SOX, CMMC, and GDPR.
Perform IT and cyber risk assessments, including risk identification, analysis, and rating, and develop risk registers and treatment plans aligned with methodologies such as NIST SP 800-30 and ISO 27005.
Conduct Business Impact Analyses to identify critical business processes, dependencies, supporting technology, and recovery objectives (RTO, RPO, and MTD), informing business continuity and disaster recovery planning.
Assess and help establish AI governance programs, including AI use-case inventories, acceptable use policies, AI risk assessments, and alignment with the NIST AI RMF, ISO/IEC 42001, and the EU AI Act.
Facilitate client workshops and interviews with executive stakeholders, process owners, and technical teams.
Assess current-state capabilities across people, process, and technology, and define target states, priorities, dependencies, and implementation roadmaps.
Translate regulatory, security, and AI requirements into tailored control environments, governance models, policies, procedures, standards, and measurable program objectives.
Develop and quality-review assessment reports, gap analyses, maturity scorecards, risk registers, control mappings, BIA reports, executive briefings, and strategic roadmaps.
Manage day-to-day engagement execution, including schedules, status reporting, and client communication; escalate scope or timeline risks to practice leadership.
Mentor engagement-team consultants and provide technical quality review of their work.
Contribute to delivery methodologies, assessment tools, templates, and reusable intellectual property.
Maintain knowledge of evolving frameworks, regulations, and industry trends, and share lessons learned with the practice.