GRC Consultant

Support detailed execution of the Controls Modernization engagement by reviewing control documentation, validating control attributes, capturing workshop outputs, documenting assessment observations, preparing control rationalization inputs, and supporting the refreshed control set, automation roadmap, and final recommendations. Primary Outcomes / Deliverables Completed control review workpapers and assessment notes for assigned Technology Operations controls. Documented observations covering gaps, duplication, unclear ownership, evidence issues, and rationalization opportunities. Workshop notes, action items, and stakeholder validation updates. Inputs to refreshed control inventory, control rationalization matrix, automation opportunity register, and executive findings summary. Quality-reviewed supporting documentation that can be used for client review and acceptance discussions., Control Documentation and Evidence Review

• Review control procedures, control descriptions, evidence artifacts, ownership details, frequency, and related process documentation.
• Compare documented control intent against stakeholder explanations and available evidence.
• Identify documentation gaps, inconsistent control language, unclear accountability, weak evidence linkage, and duplicated control activities.

• Maintain working papers and traceability notes for assigned controls. Workshop and Stakeholder Support

• Support preparation for control owner working sessions, including pre-read review and control-level questions.
• Capture notes, open items, decisions, validation outcomes, and evidence follow-ups from workshops.

• Coordinate with the GRC Lead to confirm observations, recommendations, and control disposition inputs. Rationalization and Optimization Support

• Prepare draft rationalization inputs for assigned controls, including retain, consolidate, enhance, or remove recommendations.
• Support updates to control descriptions, scope, ownership, frequency, evidence expectations, and risk alignment fields.

• Document rationale for observations and recommendations in a structured and auditable manner. Automation Roadmap Support

• Identify manual, repetitive, evidence-heavy, or testing-intensive control activities that may be candidates for automation.
• Document automation opportunity details, dependencies, readiness considerations, and expected control process benefits.

• Support development of the automation opportunity register and roadmap inputs. Deliverable Production and Quality Review

• Support creation of assessment analysis, refreshed control set, rationalization matrix, automation roadmap, and executive summary artifacts.
• Perform peer reviews for formatting, consistency, completeness, and traceability.
• Ensure all assigned updates are clearly documented and ready for GRC Lead review.

• 6-10+ years of experience in IT audit, cybersecurity GRC, technology risk, internal controls, operational risk, or control testing.
• Experience reviewing control procedures, evidence, audit findings, issue remediation documentation, or risk/control matrices.
• Financial services, banking, or regulated environment experience preferred.
• Strong documentation discipline with ability to convert workshop discussions into clear control-level observations and recommendations.

• Experience using Excel and PowerPoint to prepare control matrices, findings, dashboards, and client-facing work products. Mandatory Skills / Search Keywords Control Procedure Review, Evidence Review, IT Audit, GRC Documentation, Control Testing, Control Rationalization Support, Risk and Control Matrix, Audit Management, Workshop Notes, Action Tracking, Excel Analysis, PowerPoint Deliverables, FFIEC Awareness, COBIT Awareness, Banking Controls Preferred Certifications / Tools

• Preferred: CISA, CRISC, CIA, ISO 27001 Lead Auditor, or equivalent audit/GRC certification.
• Tools: Excel, PowerPoint, Teams, SharePoint; exposure to GRC/audit platforms such as Archer, ServiceNow GRC, MetricStream, OpenPages, or similar tools preferred.