> Markdown version of [/jobs/ext/4396099-lead-security-solutions-consultant-cyber-risk-and-strategy](https://www.wearedevelopers.com/jobs/ext/4396099-lead-security-solutions-consultant-cyber-risk-and-strategy). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Lead Security Solutions Consultant - Cyber Risk and Strategy

- **Company:** World Wide Technology
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Salary:** $137,000.0 - $172,000.0
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Cloud Computing, Control Objectives for Information and Related Technology (COBIT), Cyber Security, Intacct, PCI Data Security Standards, Program Design Languages, IT General Controls (ITGC), National Institute of Standards and Technology Cybersecurity Framework, RSA Archer Platform, CIS Benchmarks, Servicenow
- **Published:** October 8, 2026
- **Apply:** https://www.builtincolorado.com/auth/login?destination=/job/lead-security-solutions-consultant-cyber-risk-and-strategy/11597256

## About the Role

* 7-12 years of experience in cybersecurity, IT risk, compliance, or security advisory with a clear focus on GRC; must include significant hands-on experience across at least three GRC domains and demonstrated ownership of client-facing workstreams
 * Advanced hands-on experience across GRC domains and platforms, including multiple areas such as:
 + Risk Management - enterprise and IT risk assessments, risk methodology design, risk register governance, risk appetite and tolerance, qualitative or FAIR-based quantification, treatment planning, KRI design, and executive risk reporting
 + Compliance Program Management - complex regulatory and framework gap assessments, controls mapping, audit and certification readiness, evidence and remediation governance, and sustainable compliance operating models across frameworks such as SOC 2, ISO 27001, FedRAMP, HIPAA, PCI DSS, DORA, or SOX ITGC
 + Policy & Control Governance - enterprise policy and standards development, control framework design and rationalization, control testing methodology, exception governance, control ownership models, and integration of NIST, CIS, ISO, or similar frameworks
 + Third-Party & Vendor Risk - program design, vendor segmentation and tiering, inherent and residual risk methods, assessment and contractual control review, issue remediation, ongoing monitoring, and governance reporting
 + GRC Platforms - ServiceNow GRC, Archer, OneTrust, Vanta, Drata, or equivalent: experience translating process requirements into workflows, data models, reporting, dashboards, assessment structures, or platform-enabled operating processes
 * Strong working knowledge of GRC and security frameworks: NIST CSF 2.0, NIST SP 800-53, NIST RMF, ISO 27001/27002, CIS Controls v8, SOC 2 Trust Services Criteria, COBIT, PCI DSS v4, HIPAA Security Rule, SOX ITGC, FedRAMP, and DORA
 * Advanced understanding of core GRC concepts: risk appetite and tolerance, control design and operating effectiveness, three lines of defense, audit lifecycle, regulatory change management, data privacy principles, governance operating models, and risk-based prioritization

Demonstrated consulting leadership competencies, including:

 * Structured discovery: ability to design and lead current-state discovery across multiple stakeholder groups, identify information gaps, challenge assumptions constructively, and synthesize complex evidence into a coherent view of risk and program maturity
 * Gap analysis: experience leading maturity and control assessments, calibrating findings, determining root causes, prioritizing gaps by risk and business impact, and converting analysis into practical recommendations and roadmaps
 * Executive and technical communication: ability to translate complex risk and compliance topics into clear written deliverables, presentations, and verbal recommendations for technical teams, business stakeholders, project sponsors, and senior leaders
 * Workshop facilitation: ability to independently plan and facilitate discovery sessions, risk workshops, prioritization discussions, and working groups; manage differing viewpoints and guide stakeholders toward decisions and next steps
 * Deliverable leadership: consistent track record of owning high-quality client deliverables from analysis through final presentation, including quality review of team outputs and accountability for consistency, clarity, and defensibility
 * Engagement leadership: direct day-to-day workstream execution, coordinate team activities, manage dependencies and delivery risks, mentor junior staff, and partner effectively with the engagement lead to maintain scope, quality, and client confidence

Preferred

 * Bachelor's degree in Information Security, Risk Management, Business, or a related field
 * Industry certifications demonstrating advanced GRC or security knowledge: CISSP, CISM, CISA, CRISC, CGEIT, GRCP, or equivalent; platform certifications from ServiceNow, OneTrust, or Archer are a strong plus
 * Experience leading GRC work in complex enterprise environments across financial services, healthcare, retail, manufacturing, or public sector, particularly where compliance intersects with significant regulatory scrutiny
 * Substantial consulting experience at a professional services firm, systems integrator, audit/advisory firm, or equivalent client-facing role, including responsibility for workstream leadership and client presentations
 * Experience supporting pre-sales and solution shaping, including discovery, SOW development, effort estimation, staffing models, proposal creation, and transition from pursuit to delivery

Key Competencies

 * Broad GRC domain depth and independent workstream leadership
 * Client advisory judgment, delivery quality, and accountability for outcomes
 * Strong executive and technical communication, written and verbal
 * Team leadership, coaching, collaboration, and commercial awareness

Success in this role means independently leading complex GRC workstreams from discovery through recommendation, earning trusted-advisor credibility with client stakeholders, consistently delivering high-quality outcomes through both individual contribution and team leadership, strengthening the practice through coaching and reusable intellectual capital, and demonstrating the delivery, client, and commercial judgment required to progress toward a Principal or Senior Manager role.

## Description

The Lead Cyber Risk and Strategy Consultant is a senior individual contributor who owns complete delivery workstreams within WWT's Governance, Risk, Strategy and Compliance practice. Positioned above the Senior Consultant, the Lead Consultant brings broad GRC domain depth, independently drives complex client work, and serves as a trusted advisor to client stakeholders while guiding the delivery team toward high-quality outcomes.

The Lead Consultant is accountable for translating client objectives into structured delivery plans, leading assessments and workshops, shaping practical recommendations and roadmaps, and ensuring workstream outputs meet WWT's professional services standards. They work in partnership with Principals and Senior Managers, provide day-to-day direction and coaching to Senior Consultants and Consultants, and contribute meaningfully to pursuits, solution shaping, and practice development.

Essential Functions:

Engagement Delivery

 * Own end-to-end delivery of defined GRC workstreams, with accountability for scope, approach, quality, schedule, risks, dependencies, and client outcomes
 * Lead complex GRC assessments: design and conduct current-state discovery, direct control environment reviews, validate findings, calibrate maturity scoring, and ensure conclusions are supported by evidence and business context
 * Lead hands-on GRC program work across risk management, control and policy governance, compliance readiness, third-party risk, and related domains; determine the appropriate analysis approach and guide team execution
 * Own client-ready deliverables - assessment reports, risk registers, control gap registers, maturity scorecards, prioritized roadmaps, program designs, and executive summaries - and perform quality review of team outputs before client delivery
 * Plan and independently facilitate discovery sessions, stakeholder interviews, risk workshops, and working sessions; synthesize complex inputs into clear decisions, findings, and actionable recommendations
 * Lead strategy and program design activities: translate current-state findings into prioritized future-state recommendations, operating model improvements, governance structures, implementation roadmaps, and measurable program outcomes

Client Engagement

 * Build trusted relationships with client security, risk, compliance, audit, and technology leaders; serve as the primary day-to-day advisory contact for assigned workstreams and establish credibility through sound judgment and dependable delivery
 * Present findings, recommendations, and tradeoffs to project sponsors and working-group leadership; adapt communication for technical, operational, and executive audiences and confidently navigate challenge or ambiguity
 * Lead workstream status reporting, issue and risk management, meeting facilitation, decision tracking, and expectation management; escalate material delivery risks to the engagement lead with clear options and recommendations

Pursuit & Practice Support

 * Contribute materially to pre-sales and pursuit activities: lead discovery inputs, shape solution approaches, define workstream scope and deliverables, estimate level of effort, identify staffing needs, and develop proposal and SOW content in partnership with Principals and Senior Managers
 * Advance practice development by creating, improving, and governing reusable delivery assets, assessment methodologies, control libraries, accelerators, templates, and point-of-view content that increase consistency and scalability
 * Apply commercial awareness to delivery decisions: understand engagement economics, utilization, scope boundaries, staffing leverage, and change-control considerations; identify follow-on opportunities that naturally emerge from client needs without compromising advisory objectivity

Growth & Development

 * Maintain and expand advanced knowledge across GRC domains, regulatory frameworks, emerging risk topics, and relevant platforms through client work, certifications, research, and active participation in the practice
 * Seek and apply feedback from Principals and Senior Managers while demonstrating readiness for greater engagement leadership, broader client advisory responsibility, and increased contribution to solution development
 * Coach Senior Consultants and Consultants on analysis, facilitation, deliverable development, client communication, and WWT delivery standards; provide actionable review feedback and help raise overall team quality, Lead Medicaid policy analysis for a state program by translating eligibility, benefits, claims, and provider rules into analytic logic. Build production-grade data marts, registries, dashboards, reports, and cohort definitions using SQL and Python. Serve as the senior analytical partner to Medicaid leadership, contractors, vendors, and data teams; resolve data-quality issues, establish methodologies, prioritize work, and mentor analysts.
Top Skills: Amazon AthenaAmazon QuicksightAmazon RedshiftAWSClaude CodeConfluenceCpt/HcpcsCursorDbtFoundryGitIcd-10JIRAExcelNppesPower BIPythonSQLTableau

What you need to know about the Colorado Tech Scene

With a business-friendly climate and research universities like CU Boulder and Colorado State, Colorado has made a name for itself as a startup ecosystem. The state boasts a skilled workforce and high quality of life thanks to its affordable housing, vibrant cultural scene and unparalleled opportunities for outdoor recreation. Colorado is also home to the National Renewable Energy Laboratory, helping cement its status as a hub for renewable energy innovation.

Key Facts About Colorado Tech

 * Number of Tech Workers: 260,000; 8.5% of overall workforce (2024 CompTIA survey)
 * Major Tech Employers: Lockheed Martin, Century Link, Comcast, BAE Systems, Level 3
 * Key Industries: Software, artificial intelligence, aerospace, e-commerce, fintech, healthtech
 * Funding Landscape: $4.9 billion in VC funding in 2024 (Pitchbook)
 * Notable Investors: Access Venture Partners, Ridgeline Ventures, Techstars, Blackhorn Ventures
 * Research Centers and Universities: Colorado School of Mines, University of Colorado Boulder, University of Denver, Colorado State University, Mesa Laboratory, Space Science Institute, National Center for Atmospheric Research, National Renewable Energy Laboratory, Gottlieb Institute