Risk Management Consultant – GRC Practice

Artemis Connection•Seattle, WA

2d•Remote

About The Position

In this role, you will help clients build and mature enterprise risk programs that address the full spectrum of organizational exposure, including strategic, operational, financial, regulatory, and reputational risk, with cybersecurity treated as one critical dimension of a broader risk universe rather than the primary lens. This is a client-facing role that demands genuine enterprise risk fluency. You should be as comfortable discussing board risk appetite statements and third-party concentration risk as you are reviewing a cybersecurity control framework. The clients who need you most are the ones whose risk programs have been captured by a single function, usually IT or legal, and who need help building something that actually reflects how the organization operates and where it is genuinely exposed.

Requirements

Minimum 5 to 7 years of experience in enterprise risk management, internal audit, management consulting, or a closely related discipline
Hands-on experience with COSO ERM, ISO 31000, or a comparable ERM framework, demonstrated through program design or maturity assessments, not just familiarity
Demonstrated experience working directly with senior leadership and boards, including the ability to facilitate difficult conversations about risk without losing the room
Deep understanding of how organizational risk programs are designed, where they tend to fail, and what separates a risk register that drives decisions from one that sits unused in a SharePoint folder
Sufficient cybersecurity literacy to engage meaningfully with IT and security teams, interpret control assessments, and translate technical findings into enterprise risk terms, including familiarity with NIST CSF, ISO 27001, or comparable frameworks
Strong written and verbal communication skills, including the ability to distill complex risk landscapes into clear, board-ready summaries

Nice To Haves

Relevant professional certifications such as CRISC, CRMA, CIA, CISM, or an MBA or advanced degree in risk, finance, or a related field
Minimum 2+ years of consulting or client-facing advisory experience
Familiarity with sector-specific regulatory environments such as financial services, healthcare, defense, critical infrastructure, or emerging technology
Experience with quantitative or semi-quantitative risk methodologies such as FAIR