Security GRC - Principal Cyber Risk Advisor

ECI

5d•$140,000 - $150,000•Remote

About The Position

ECI is seeking a Principal Cyber Risk Advisor to work with clients across industries to strengthen security postures, lead compliance programs, and serve as a strategic partner to executive leadership. The role owns hands-on work—including policy development, assessments, audits, and board-level advice—and collaborates with ECI's internal teams to manage client workflows. The advisor is a senior technical and strategic resource across complex client engagements. They lead multi-framework compliance programs, including CMMC, TISAX, NIST, ISO 27001, SOC 2, and SEC requirements, and help clients turn evolving regulatory obligations into prioritized, actionable programs. The role also leads risk management, audit lifecycle activities, vendor reviews, and security-focused M&A due diligence; mentors colleagues; and contributes to GRC practice materials and quality assurance.

Requirements

7–10+ years of experience in information security, GRC, or IT risk, with continuous career growth in a consulting or advisory environment.
At least 3 years in a client-facing advisory, vCISO, or principal consultant role, with experience owning C-suite client relationships.
Hands-on experience managing multi-framework compliance programs such as CMMC, NIST, SOC 2, ISO 27001, or TISAX.
Experience supporting M&A transactions from a GRC or security perspective, including due diligence, gap analysis, or integration planning.
Bachelor's degree in Computer Science, Information Systems, or a related field.
Deep working knowledge of CMMC 2.0, NIST SP 800-171/800-172, DFARS 252.204-7012, NIST CSF/RMF/SP 800-53, HITRUST, and SEC cybersecurity rules.
Knowledge of TISAX requirements, including ISA categories, maturity levels, the VDA ISA control catalogue, and the ENX assessment process.
Strong understanding of security controls and practices such as MFA, Conditional Access, Least Privilege, and Defense in Depth.
Experience with endpoint and cloud security platforms such as CrowdStrike, SentinelOne, Microsoft 365, or Cisco.
Exceptional written and verbal communication skills, including the ability to brief boards, write formal audit policies, and mentor junior analysts.
Ability to manage multiple concurrent, time-sensitive workstreams and independently drive schedules and timelines to completion.
Strong business acumen, ability to explain technical topics in concrete, client-specific terms, and strong interpersonal and collaboration skills.

Nice To Haves

Previous consulting experience in financial services, healthcare, government, manufacturing, or the DIB sectors.
An advanced degree.
Two or more relevant certifications are preferred, including CISSP, CISM, CMMC Registered Practitioner (RP) or Certified Professional (CCP), or ISO/IEC 27001 Lead Implementer or Lead Auditor.
CRISC or CISA certification.
Familiarity with GRC tools such as Vanta, Cynomi, Drata, Archer, or ServiceNow GRC.
Ability to obtain CMMC RP or CCP certification within 6 months, if not already held.

Responsibilities

Serve as a senior advisor to client CTOs, CISOs, and executive leadership, owning strategic direction and day-to-day execution across multiple engagements.
Lead steering sessions, quarterly program reviews, and board-level risk briefings, including preparing and delivering materials.
Develop and maintain GRC roadmaps aligned with client business priorities, regulatory calendars, and risk appetite.
Translate regulatory and technical requirements into actionable guidance for operational, technical, and executive stakeholders.
Respond to client security questions and build detailed knowledge of client environments, systems, and supply chains.
Develop and implement risk management strategies and maintain enterprise GRC risk registers, including risk identification, scoring, treatment, and reporting.
Conduct security architecture analyses, identify vulnerabilities, propose countermeasures, and facilitate risk workshops and annual Security Program Reviews.
Manage concurrent multi-framework compliance programs, including CMMC Level 2, TISAX, and ISO 27001 activities and deliverables.
Own the audit lifecycle, including readiness, evidence collection, auditor liaison, and remediation, across up to four certification engagements per year.
Develop, review, and maintain client information security policies and procedures, updating them against applicable standards and regulations.
Own vendor due diligence programs, including SOC 2 Type II analysis, security questionnaire reviews, risk scoring, and contractual flow-down verification.
Lead GRC due diligence for M&A targets, assess security posture, compliance gaps, and integration risk, and produce diligence reports and post-acquisition integration roadmaps.
Mentor team members and contribute to their professional growth and GRC practice capabilities.
Maintain and improve compliance playbooks, templates, and methodologies using lessons from client engagements.
Participate in internal quality assurance and peer reviews of client deliverables.