> Markdown version of [/jobs/ext/2102103-grc-consultant](https://www.wearedevelopers.com/jobs/ext/2102103-grc-consultant). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# GRC Consultant

- **Company:** Spectraforce
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Contract:** Temporary contract
- **Skills:** Microsoft Excel, Control Objectives for Information and Related Technology (COBIT), Information Technology Audit, Microsoft PowerPoint, Microsoft SharePoint, Control Language, Servicenow
- **Published:** August 18, 2026
- **Apply:** http://leoforce.us/Careers/Spectraforce/JobDetails.html?jobid=9c801ae3-5e70-4aba-9aba-a0d509685734&OrgId=1&UserId=4899

## About the Role

* 6-10+ years of experience in IT audit, cybersecurity GRC, technology risk, internal controls, operational risk, or control testing.
 * Experience reviewing control procedures, evidence, audit findings, issue remediation documentation, or risk/control matrices.
 * Financial services, banking, or regulated environment experience preferred.
 * Strong documentation discipline with ability to convert workshop discussions into clear control-level observations and recommendations.
 * Experience using Excel and PowerPoint to prepare control matrices, findings, dashboards, and client-facing work products.
Mandatory Skills / Search Keywords
Control Procedure Review, Evidence Review, IT Audit, GRC Documentation, Control Testing, Control Rationalization Support, Risk and Control Matrix, Audit Management, Workshop Notes, Action Tracking, Excel Analysis, PowerPoint Deliverables, FFIEC Awareness, COBIT Awareness, Banking Controls
Preferred Certifications / Tools

 * Preferred: CISA, CRISC, CIA, ISO 27001 Lead Auditor, or equivalent audit/GRC certification.
 * Tools: Excel, PowerPoint, Teams, SharePoint; exposure to GRC/audit platforms such as Archer, ServiceNow GRC, MetricStream, OpenPages, or similar tools preferred.

## Description

Support detailed execution of the Controls Modernization engagement by reviewing control documentation, validating control attributes, capturing workshop outputs, documenting assessment observations, preparing control rationalization inputs, and supporting the refreshed control set, automation roadmap, and final recommendations.
Primary Outcomes / Deliverables
Completed control review workpapers and assessment notes for assigned Technology Operations controls.
Documented observations covering gaps, duplication, unclear ownership, evidence issues, and rationalization opportunities.
Workshop notes, action items, and stakeholder validation updates.
Inputs to refreshed control inventory, control rationalization matrix, automation opportunity register, and executive findings summary.
Quality-reviewed supporting documentation that can be used for client review and acceptance discussions., Control Documentation and Evidence Review

 * Review control procedures, control descriptions, evidence artifacts, ownership details, frequency, and related process documentation.
 * Compare documented control intent against stakeholder explanations and available evidence.
 * Identify documentation gaps, inconsistent control language, unclear accountability, weak evidence linkage, and duplicated control activities.
 * Maintain working papers and traceability notes for assigned controls.
Workshop and Stakeholder Support

 * Support preparation for control owner working sessions, including pre-read review and control-level questions.
 * Capture notes, open items, decisions, validation outcomes, and evidence follow-ups from workshops.
 * Coordinate with the GRC Lead to confirm observations, recommendations, and control disposition inputs.
Rationalization and Optimization Support

 * Prepare draft rationalization inputs for assigned controls, including retain, consolidate, enhance, or remove recommendations.
 * Support updates to control descriptions, scope, ownership, frequency, evidence expectations, and risk alignment fields.
 * Document rationale for observations and recommendations in a structured and auditable manner.
Automation Roadmap Support

 * Identify manual, repetitive, evidence-heavy, or testing-intensive control activities that may be candidates for automation.
 * Document automation opportunity details, dependencies, readiness considerations, and expected control process benefits.
 * Support development of the automation opportunity register and roadmap inputs.
Deliverable Production and Quality Review

 * Support creation of assessment analysis, refreshed control set, rationalization matrix, automation roadmap, and executive summary artifacts.
 * Perform peer reviews for formatting, consistency, completeness, and traceability.
 * Ensure all assigned updates are clearly documented and ready for GRC Lead review.


## Related Videos

- [Applying Agile Principles to Incident Management ](https://www.wearedevelopers.com/videos/101-applying-agile-principles-to-incident-management)
- [One Pipeline, Three Regulator - SBOM Compliance for the Developer](https://www.wearedevelopers.com/videos/100169-one-pipeline-three-regulator-sbom-compliance-for-the-developer)
- [In-depth .NET Azure Functions: Isolated mode, performance and durable AI agents](https://www.wearedevelopers.com/videos/100207-in-depth-net-azure-functions-isolated-mode-performance-and-durable-ai-agents)
- [Create DSL (Domain Specific Language) on top of Swift](https://www.wearedevelopers.com/videos/707-create-dsl-domain-specific-language-on-top-of-swift)
- [Robots are coming into the wild! Full-Stack Robotics Engineers, be ready!](https://www.wearedevelopers.com/videos/479-robots-are-coming-into-the-wild-full-stack-robotics-engineers-be-ready)
- [Great DevEx and Regulatory Compliance - Possible?](https://www.wearedevelopers.com/videos/1426-great-devex-and-regulatory-compliance-possible)

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)
- [Résumé-Driven Development: How IT trends affect the job market for software developers](https://www.wearedevelopers.com/magazine/59-resume-driven-development-how-it-trends-affect-the-job-market-for-software-developers)
- [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)
- [Best US AI Conferences for CTOs in 2026: Build vs. Buy, Vendor Evaluation, and Peer Intelligence](https://www.wearedevelopers.com/magazine/736-best-us-ai-conferences-for-ctos-in-2026-build-vs-buy-vendor-evaluation-and-peer-intelligence)
- [Best Companies to work for in London: Top 25 Companies in 2023](https://www.wearedevelopers.com/magazine/187-best-companies-to-work-for-in-london-top-25-companies-in-2023)