Sr. Consultant - Strategy & Risk | Remote, USA

Optiv•Tampa, FL

1d•Remote

About The Position

Optiv’s consultants are skilled technical and consultative resources expected to be strong in both technical and soft skills. The Sr. Consultant – Strategy & Risk plays a key role in delivering security solutions, conducting risk and compliance assessments, and supporting client engagements. The position balances technical skills, risk management knowledge, and client-facing consulting experience to help organizations improve their security posture and achieve compliance. This role supports clients with AI risk and governance, governance, risk, and compliance (GRC) processes, cybersecurity strategy and transformation, insider risk, and cyber asset intelligence and attack surface management. The consultant may work independently or lead complex engagements, serve as an escalation point for other delivery consultants, and collaborate with Principal Consultants and Technical Managers. The position is fully remote and may be hired anywhere in the continental U.S.; travel may be needed to meet client needs.

Requirements

Bachelor's degree and approximately 5–7 years of related work experience; prior consultancy experience is preferred.
Experience leading cybersecurity strategy and transformation engagements, including current-state assessments, target-state capability design, operating models, strategic roadmaps, investment prioritization, and executive-level recommendations.
Experience designing, implementing, or maturing enterprise cybersecurity and GRC programs across governance, risk management, controls, regulatory compliance, policy management, risk reporting, and cybersecurity metrics.
Experience assessing or developing insider risk programs, including threat scenarios, governance, identity and access risks, data protection, monitoring considerations, investigation and response processes, and cross-functional stakeholder engagement.
Experience developing cyber asset intelligence, asset management, or attack surface management capabilities, including discovery, ownership, classification, criticality, vulnerability and exposure management, and use of asset intelligence in cybersecurity risk decisions.
Ability to advise senior executives and cybersecurity leaders, facilitate strategic workshops, translate technical and regulatory issues into business risk, and develop recommendations, operating models, and multi-year transformation roadmaps.
Experience supporting AI governance, AI risk assessments, or evaluation of security, privacy, and third-party risks associated with enterprise AI adoption.
Experience translating GRC assessment findings into prioritized remediation roadmaps, governance documentation, and business-focused recommendations.
Familiarity with GRC platforms and tools for managing risks, controls, compliance evidence, and reporting; hands-on experience is preferred.
Hold or pursue relevant cybersecurity and risk management certifications such as CISSP, CISM, CRISC, CCSP, CMMC CCP/CCA, or ISO 27001 Lead Implementer.
The successful candidate must hold related professional certifications such as CISSP, CISM, and/or CISA.
Strong understanding of cybersecurity frameworks such as NIST, ISO 27001, CMMC, CIS, PCI, and HIPAA.
Hands-on experience with security assessments, risk management, compliance assessments, policies and standards, and related risk and compliance activities.
Experience in cyber resilience, including Business Continuity Planning, Disaster Recovery, Business Impact Analysis, and Operational Resilience.
Strong analytical and problem-solving skills for cybersecurity challenges.
Excellent communication and report-writing skills for client engagements.
Ability to manage multiple projects and work independently in a fast-paced environment.
Willingness to travel to meet client needs.
Valid driver's license in the U.S.

Nice To Haves

Prior consultancy experience.
Hands-on experience with GRC platforms and tools used to manage risks, controls, compliance evidence, and reporting.
Relevant certifications such as CISSP, CISM, CRISC, CCSP, CMMC CCP/CCA, or ISO 27001 Lead Implementer.

Responsibilities

Assess risks associated with artificial intelligence, including generative AI and third-party AI solutions, and develop governance and risk mitigation recommendations.
Help clients develop AI governance policies, acceptable-use standards, oversight processes, and controls aligned with business objectives and risk management programs.
Strengthen client GRC processes, including risk registers, control mapping, evidence collection, issue management, and remediation tracking.
Lead cybersecurity advisory engagements to assess current-state capabilities, define target-state operating models, and develop multi-year cybersecurity and GRC strategies, transformation roadmaps, and prioritized investment plans.
Advise clients on enterprise cybersecurity and GRC program design and maturity, including governance structures, risk frameworks, control environments, policies and standards, metrics, executive reporting, and operating models.
Design and mature insider risk programs, including governance, risk scenarios, monitoring and response processes, and cross-functional operating models.
Assess and develop cyber asset intelligence and attack surface management programs across traditional IT, cloud, SaaS, and other technology environments.
Develop executive-level cybersecurity strategies and business cases that translate risks, control gaps, regulatory requirements, and emerging threats into prioritized initiatives, measurable outcomes, investment decisions, and transformation roadmaps.
Work independently or lead complex projects, and serve as an engagement escalation point for other delivery team consultants.
Work with clients to define, build, and implement security leading practices.
Conduct risk assessments, security readiness audits, and gap analyses against compliance and regulatory frameworks.
Assess compliance with industry standards and regulatory frameworks such as NIST 800-171/53, ISO 27001, COSO, CMMC, HIPAA, and PCI.
Assist clients in developing risk management frameworks and mitigation strategies.
Conduct third-party risk assessments of client supply chains and key vendors.
Support the design and implementation of cybersecurity policies, procedures, and governance frameworks.
Develop and refine security strategy assessments, security program plans, and POA&Ms.
Translate security operational and technical risks into business implications and recommendations for stakeholders.
Conduct workshops, stakeholder interviews, security awareness sessions, and presentations with client stakeholders.
Collaborate with Principal Consultants and Technical Managers to support client objectives.
Maintain clear documentation and reporting of security findings, analysis, and recommendations.
Stay current on cybersecurity, risk management, key technologies, and regulations.
Contribute to thought leadership through research, whitepapers, and presentations.
Provide knowledge transfer and post-production support as necessary.