Sr. Consultant - Strategy & Risk | Remote, USA

Optiv • Leawood, KS

1d • Remote

About The Position

Optiv’s Sr. Consultant – Strategy & Risk is a client-facing cybersecurity consulting role responsible for delivering security solutions, conducting risk and compliance assessments, and supporting client engagements. The role combines technical capability, risk management expertise, and consulting skills to help organizations improve their security posture and achieve compliance. It is fully remote and can be hired anywhere in the continental United States, with travel to meet client needs.

The consultant supports strategic cybersecurity and GRC advisory work, including assessing current-state capabilities, defining target-state operating models, and developing multi-year strategies, roadmaps, and investment plans. The role also addresses AI governance and risk, insider risk, cyber asset intelligence and attack surface management, third-party risk, regulatory compliance, and cyber resilience. Consultants work independently or lead complex engagements, advise client stakeholders, document findings, and contribute to knowledge sharing and thought leadership.

Requirements

• Bachelor’s degree and approximately 5–7 years of related work experience; prior consultancy experience is preferred.
• Experience leading cybersecurity strategy and transformation engagements, including current-state assessments, target-state capability design, operating models, roadmaps, investment prioritization, and executive recommendations.
• Experience designing, implementing, or maturing enterprise cybersecurity and GRC programs across governance, risk management, controls, regulatory compliance, policy management, risk reporting, and cybersecurity metrics.
• Experience assessing or developing insider risk programs, including threat scenarios, governance, identity and access risks, data protection, monitoring considerations, investigation and response processes, and cross-functional engagement.
• Experience developing cyber asset intelligence, asset management, or attack surface management capabilities, including asset discovery, ownership, classification, criticality, vulnerability and exposure management, and use of asset intelligence in risk decisions.
• Ability to advise senior executives and cybersecurity leaders, facilitate strategic workshops, translate technical and regulatory issues into business risk, and develop recommendations, operating models, and multi-year roadmaps.
• Experience supporting AI governance, AI risk assessments, or evaluation of security, privacy, and third-party risks related to enterprise AI adoption.
• Experience translating GRC assessment findings into prioritized remediation roadmaps, governance documentation, and business-focused recommendations.
• Familiarity with GRC platforms and tools used to manage risks, controls, compliance evidence, and reporting; hands-on experience is preferred.
• Hold or pursue relevant cybersecurity and risk management certifications, such as CISSP, CISM, CRISC, CCSP, CMMC CCP/CCA, or ISO 27001 Lead Implementer.
• Must hold relevant professional certifications such as CISSP, CISM, and/or CISA.
• Strong understanding of cybersecurity frameworks such as NIST, ISO 27001, CMMC, CIS, PCI, and HIPAA.
• Hands-on experience with security assessments, risk management, compliance assessments, policies and standards, and related risk and compliance activities.
• Experience in cyber resilience, including Business Continuity Planning, Disaster Recovery, Business Impact Analysis, and Operational Resilience.
• Strong analytical and problem-solving skills for cybersecurity challenges.
• Excellent communication and report-writing skills for client engagements.
• Ability to manage multiple projects and work independently in a fast-paced environment.
• Willingness to travel to meet client needs.
• Valid U.S. driver’s license.

Nice To Haves

• Prior consultancy experience.
• Hands-on experience with GRC platforms and tools.

Responsibilities

• Assess risks associated with generative AI and third-party AI solutions, and recommend governance and risk mitigation actions.
• Help clients develop AI governance policies, acceptable-use standards, oversight processes, and controls aligned with business objectives and risk programs.
• Strengthen client GRC processes, including risk registers, control mapping, evidence collection, issue management, and remediation tracking.
• Lead strategic cybersecurity advisory engagements, assessing current-state capabilities and defining target-state operating models, strategies, transformation roadmaps, and prioritized investment plans.
• Advise on enterprise cybersecurity and GRC programs, including governance structures, risk frameworks, control environments, policies, standards, metrics, executive reporting, and operating models.
• Design and mature insider risk programs, including governance, risk scenarios, monitoring and response processes, and cross-functional operating models.
• Assess and develop cyber asset intelligence and attack surface management programs across traditional IT, cloud, SaaS, and other technology environments.
• Develop executive-level cybersecurity strategies and business cases that translate risks, control gaps, regulatory requirements, and emerging threats into prioritized initiatives and measurable outcomes.
• Work independently or lead complex engagements, and serve as an escalation point for other delivery consultants.
• Work with clients to define, build, and implement security leading practices.
• Conduct risk assessments, security readiness audits, and gap analyses against compliance and regulatory frameworks.
• Assess compliance with standards and frameworks such as NIST 800-171/53, ISO 27001, COSO, CMMC, HIPAA, and PCI.
• Help clients develop risk management frameworks and mitigation strategies.
• Conduct third-party risk assessments of client supply chains and key vendors.
• Support the design and implementation of cybersecurity policies, procedures, and governance frameworks.
• Develop and refine security strategy assessments, security program plans, and POA&Ms.
• Translate operational and technical risks into business implications and recommendations for stakeholders.
• Conduct workshops, stakeholder interviews, security awareness sessions, and presentations.
• Collaborate with Principal Consultants and Technical Managers to support client objectives.
• Maintain clear documentation and reporting of security findings, analysis, and recommendations.
• Stay current on cybersecurity, risk management, technologies, and regulations.
• Contribute to thought leadership through research, whitepapers, and presentations.
• Provide knowledge transfer and post-production support as needed.

Benefits

• Inclusive workplace supported by Employee Resource Groups.
• Work/life balance.
• Professional training resources.
• Creative problem-solving opportunities and work on unique, complex projects.
• Volunteer opportunities through Optiv Chips In.
• Technology and resources to work productively remotely or from home, where applicable.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior