Cybersecurity GRC Consultant (Contract)

CoreFactor Inc.•Mississauga, ON

4d•Hybrid

About The Position

CoreFactor is searching for a Cybersecurity GRC Consultant on a contract basis for a client in the GTA. This position is hybrid and will require the successful incumbent to go into the Mississauga office four (4) times per week. As our Governance, Risk Management, and Compliance (GRC) Analyst, you will report to the Director of Security Strategy and Architecture to help us build and grow our cyber practice from the ground up. This is a rare opportunity to join us on our journey on the forefront of cybersecurity, grow with us, and shape the future of the organization. This role requires a motivated self-starter, someone who has strong analytical and problem-solving skills, a deep understanding of risk and compliance management principles, excellent communication and report-writing abilities, and foundational knowledge of industry-specific regulations, standards, and frameworks. You are passionate about security and compliance and believe in due diligence.

Requirements

Understand Information Security Concepts (such as Risk Management, Governance, Data Protection, Incident Management etc.)
Knowledge of information security standards and regulations such as NIST CSF, NIST SP Series (800-53, 800-82, 800-207), NIST RMF (Risk Management Framework), C3, and CIS Critical Security Controls framework
Quick learner, strategic thinker, strong team player with ability to multi-task
Organize, prioritize, and track project activities on a day-to-day basis
Identify and communicate project risks to managers and IT leads
Analytical and problem-solving mindset
Clear verbal/written communication
Proficiency in Excel, PowerPoint
Risk assessment and risk analysis
Risk register management and remediation tracking
Control design and operating effectiveness assessment
Audit evidence review and audit readiness
Third-party risk management and vendor due diligence
Policy, standard, and procedure interpretation
Security control framework mapping, including NIST CSF, CIS Controls, ISO 27001, SOC 2, and NIST 800-53
KRI/KPI development, tracking, and reporting
Executive reporting and dashboard preparation
Exception, issue, and risk acceptance management
Data classification and data protection risk analysis
Cloud, IAM, infrastructure, and resilience risk assessment
Strong documentation and report-writing skills
Stakeholder management and cross-functional coordination
GRC tool proficiency, such as ServiceNow GRC/IRM, Archer, OneTrust, AuditBoard, MetricStream, or similar platforms
Ability to work collaboratively with members across other functions (such as Infrastructure, Cloud, Data etc.) to collaboratively solve problems and build strong processes
Track risks assigned to members within other functions (such as Infrastructure, Cloud, Data etc.)
A minimum of 3 years of security related experience within GRC function
A minimum of 7 years of security related experience in total within various information security functions (GRC, MITRE ATT&CK, Resilience etc.)
Experience in conducting risk assessments as per requirements in industry leading standards and frameworks (such as NIST CSF) is a must.
Experience with GRC tools — such as Archer, ServiceNow GRC/IRM, OneTrust, AuditBoard, MetricStream, or similar platforms.

Nice To Haves

Experience in conducting ITGC (IT General Controls) controls testing (Preferred)
Experience in Data Protection, Third-party Risk Management and Resilience (Preferred)
Prior experience in working in Consumer or Food & Beverage Industry (Preferred)
Bachelor's degree in Information Technology, Engineering or Computer Science (Preferred)
Professional certifications in Information Security such as CISSP, CISM, CRISC, CC or equivalent (Preferred)

Responsibilities

Work with leaders (such as CIO, CISO, GRC Manager, Infrastructure Managers) and assist them in strengthening the organization-wide Cybersecurity program
Work with stakeholders and implement Governance Risk and Compliance (GRC) related initiatives aligned with the organizations vision and strategy
Conduct risk assessments as per requirements within industry leading standards and frameworks (such as NIST CSF), identify gaps and assist in coordination of activities among other information security functions to resolve the gaps
Be the primary point of contact for external assessments, audits and participate in interviews, walkthroughs and requirements gathering process
Lead internal assessments (GRC) and audits, and conduct interviews, documentation review and controls assessment
Assist in implementation of requirements defined within Cybersecurity related policies and procedures throughout the organization
Collaborate with other information security functions (such as IAM, PAM, Resilience etc.) and collect Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs), and periodically report it to GRC Manager
Prepare information security reports for senior leaders (such as CIO, CISO and the Cybersecurity Committee)
Assist in Implementation of cyber security controls and management of the Cyber Controls Framework (NIST CSF)
Assist in development of cyber security related training and awareness initiatives
Keep track of risks within the organization. Ensure risks are appropriately addressed by risk owners within the determined timeline.
Work with required teams to collect and prepare audit data for C3 audits.
Risk register ownership and lifecycle management — documenting risks, assigning owners, tracking remediation, validating closure, and preparing risk status updates.
Control testing and evidence review — assessing control design and operating effectiveness, reviewing audit evidence, and identifying gaps.
Third-party/vendor risk assessments — reviewing security questionnaires, SOC 2 reports, ISO 27001 certificates, penetration test summaries, and remediation plans.
Risk reporting for leadership — preparing executive-level dashboards, KRIs/KPIs, risk summaries, and remediation progress updates.
Framework mapping — mapping risks and controls to NIST CSF, CIS Controls, ISO 27001, SOC 2, or internal control frameworks.
Exception and risk acceptance management — documenting exceptions, residual risk, compensating controls, expiry dates, and approval workflows.
Data classification and privacy/security risk — evaluating how sensitive data is collected, stored, transmitted, retained, and protected.
Cloud and infrastructure risk assessments — assessing risks related to cloud platforms, IAM, network security, endpoint controls, backup/recovery, and resilience.
Audit readiness and compliance support — preparing teams for audits, collecting evidence, coordinating responses, and tracking findings to closure.