> Markdown version of [/jobs/ext/2284533-senior-security-solutions-consultant-cyber-risk-and-strategy](https://www.wearedevelopers.com/jobs/ext/2284533-senior-security-solutions-consultant-cyber-risk-and-strategy). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Security Solutions Consultant - Cyber Risk and Strategy

- **Company:** World Wide Technology
- **Location:** Maryland Heights, MO, United States
- **Experience:** Expert
- **Salary:** $146,500.0 - $185,000.0
- **Contract:** Permanent contract
- **Skills:** Control Objectives for Information and Related Technology (COBIT), Cyber Security, PCI Data Security Standards, Program Design Languages, IT General Controls (ITGC), RSA Archer Platform, CIS Benchmarks, Servicenow
- **Published:** August 28, 2026
- **Apply:** https://www.businessworkforce.com/job.asp?id=3367888404&tx=UT5248TYV&pt=1&aff=0B19D771-A501-4A5E-8338-2A822B784D54&utm_source=Job%20Feed&utm_medium=textkernel&utm_campaign=DE&utm_term=0B19D771-A501-4A5E-8338-2A822B784D54

## About the Role

* 4-8 years of experience in cybersecurity, IT risk, or compliance with a clear focus on GRC; must include hands-on experience with at least two GRC domains (risk management, compliance program management, policy governance, or third-party risk)
 * Hands-on experience across GRC domains and platforms, including one or more of:
 * Risk Management - enterprise and IT risk assessments, risk register development, risk quantification (FAIR or qualitative), risk treatment planning, and KRI design
 * Compliance Program Management - regulatory gap assessments, controls mapping, audit readiness, evidence collection workflows, and remediation tracking against frameworks such as SOC 2, ISO 27001, FedRAMP, HIPAA, PCI DSS, DORA, or SOX ITGC
 * Policy & Control Governance - policy development and review cycles, control framework design (NIST, CIS, ISO), control testing methodology, and policy exception management
 * Third-Party & Vendor Risk - vendor risk tiering, assessment questionnaire management, contractual control review, and ongoing monitoring program design
 * GRC Platforms - ServiceNow GRC, Archer, OneTrust, Vanta, Drata, or equivalent: workflow configuration, risk and compliance module setup, or reporting and dashboard design
 * Working knowledge of GRC and security frameworks: NIST CSF 2.0, NIST SP 800-53, NIST RMF, ISO 27001/27002, CIS Controls v8, SOC 2 Trust Services Criteria, COBIT, PCI DSS v4, HIPAA Security Rule, SOX ITGC, FedRAMP, and DORA
 * Understanding of core GRC concepts: risk appetite and tolerance, control design vs. control effectiveness, separation of duties, three lines of defense, audit lifecycle, regulatory change management, and data privacy principles

Demonstrated consulting delivery competencies, including:

 * Structured discovery: ability to conduct current-state discovery interviews, gather documentation and evidence, manage information collection across workstreams, and synthesize findings into clear, structured outputs
 * Gap analysis: experience assessing GRC program maturity against frameworks, documenting control gaps, and prioritizing findings by risk and business impact
 * Technical communication: ability to translate risk and compliance findings into clear written deliverables and verbal summaries for technical and working-level client audiences
 * Workshop facilitation: participate in and contribute to discovery sessions, risk workshops, and working-group meetings; begin developing the ability to facilitate independently
 * Deliverable quality: consistent track record of producing accurate, well-structured client deliverables, assessment reports, risk registers, gap analyses, and roadmap presentations, on time and to standard
 * Engagement collaboration: work effectively within project teams; communicate status, risks, and issues proactively to the engagement lead; adapt to shifting priorities and client needs

Preferred

 * Bachelor's degree in Information Security, Risk Management, Business, or a related field
 * Industry certifications demonstrating GRC knowledge: CISSP, CISM, CISA, CRISC, CGEIT, GRCP, Security+, or equivalent; platform certifications from ServiceNow, OneTrust, or Archer are a strong plus
 * Experience in enterprise environments across financial services, healthcare, retail, manufacturing, or public sector, particularly where compliance intersects with regulatory scrutiny (SOX, HIPAA, PCI DSS, DORA, FedRAMP)
 * Prior consulting experience at a professional services firm, systems integrator, or equivalent client-facing advisory role
 * Familiarity with pre-sales processes: SOW development, effort estimation, or proposal support

Key Competencies

 * GRC domain depth and hands-on program execution
 * Delivery quality and individual accountability
 * Clear technical communication, written and verbal
 * Collaborative team contributor with a growth orientation

Success in this role means executing GRC deliverables with high quality and growing independence, building credibility with client teams through consistent performance, expanding domain depth and consulting skills, and contributing to a practice that clients trust and return to while building toward the skills and experience required to step into a Lead Consultant role, WWT will consider for employment, without regard to disability, a disabled applicant who satisfies the requisite skill, experience, education, and other job-related requirements of the job and is capable of performing the essential requirements of the job with or without reasonable accommodation. World Wide Technology is an Equal Opportunity Employer. Employment decisions are made without regard to race, color, religion, sex (including pregnancy), sexual orientation, gender identity, national origin, age, disability, veteran status, genetic information, or other characteristics protected by law. We are committed to working with and providing reasonable accommodations to individuals with disabilities. If you have a disability and you believe you need a reasonable accommodation in order to search for a job opening or to submit an online application, please call 1-800-432-7008 and ask for Human Resources.

## Description

The Senior Cyber Risk and Strategy Consultant is a skilled individual contributor who owns defined delivery tasks and workstream components within WWT's Governance, Risk, Strategy and Compliance practice. Positioned below the Lead Consultant, the Senior Consultant brings hands-on depth across GRC domains, executes high-quality client deliverables with growing independence, and begins developing trusted client relationships at the working level., The Senior Consultant is the engine of GRC delivery, leading risk assessments, facilitating compliance gap analyses, supporting policy and control design, and producing the analytical outputs that underpin client recommendations. They work under the direction of a Lead Consultant, Principal or Senior Manager, and are expected to grow steadily toward owning full workstreams and contributing to pre-sales activities., Engagement Delivery

 * Execute assigned delivery tasks and workstream components within GRC engagements with accountability for quality, accuracy, and on-time completion
 * Lead technical components of GRC assessments: conduct current-state discovery, perform control environment reviews, document findings, and score maturity against defined frameworks with guidance from the engagement lead
 * Perform hands-on GRC work: risk register development, control mapping and gap analysis, policy review and drafting, compliance readiness assessments, and third-party risk evaluation
 * Produce client-ready deliverables - assessment findings, risk registers, control gap registers, maturity scorecards, roadmap inputs, and executive summaries - that meet WWT's professional services quality standards
 * Facilitate discovery sessions, stakeholder interviews, and working-level workshops; synthesize findings into structured outputs for Lead Consultant review
 * Support strategy and program design activities: document current-state compliance posture, identify gaps and risks, and contribute to future-state program recommendations under direction of the Lead Consultant or Senior Manager

Client Engagement

 * Build working-level relationships with client technical teams, compliance officers, and project stakeholders; establish credibility as a reliable, knowledgeable GRC resource throughout the engagement
 * Communicate findings clearly and accurately to client counterparts; begin developing the ability to present findings to project sponsors and working-group leadership
 * Contribute to client status reporting, meeting facilitation, and action item tracking under the direction of the engagement lead

Pursuit & Practice Support

 * Support pre-sales and pursuit activities: contribute to SOW scoping, effort estimation, and proposal content under the direction of the Lead Consultant or Senior Manager
 * Contribute to practice development through reusable delivery assets, assessment templates, control libraries, and technical write-ups
 * Begin developing commercial awareness: understand engagement economics, utilization expectations, and how delivery quality connects to client satisfaction and account growth

Growth & Development

 * Actively build depth across GRC domains and regulatory frameworks through project work, certifications, and self-directed learning
 * Seek and apply feedback from Lead Consultants and Senior Managers; demonstrate consistent growth in delivery independence, communication quality, and domain breadth
 * Begin supporting and coaching more junior colleagues on technical tasks and WWT delivery standards, We strive to create an environment where all employees are empowered to succeed based on their skills, performance, and dedication. Our goal is to cultivate a culture of belonging that encourages innovation, collaboration, and respect for all team members, ensuring that WWT remains a great place to work for All!


## Related Videos

- [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure)
- [A practical guide to writing secure Dockerfiles](https://www.wearedevelopers.com/videos/109-a-practical-guide-to-writing-secure-dockerfiles)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [Applying Agile Principles to Incident Management ](https://www.wearedevelopers.com/videos/101-applying-agile-principles-to-incident-management)
- [OPA for the cloud natives](https://www.wearedevelopers.com/videos/713-opa-for-the-cloud-natives)
- [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large)

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)
- [Résumé-Driven Development: How IT trends affect the job market for software developers](https://www.wearedevelopers.com/magazine/59-resume-driven-development-how-it-trends-affect-the-job-market-for-software-developers)
- [Should senior developers refuse interview coding challenges?](https://www.wearedevelopers.com/magazine/29-should-senior-developers-refuse-interview-coding-challenges)
- [What Makes WeAreDevelopers World Congress Different From Every Other Tech Event?](https://www.wearedevelopers.com/magazine/701-what-makes-wearedevelopers-world-congress-different-from-every-other-tech-event)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)