Risk Advisory GRC Consultat - Remote (USA)

About us: At Echelon Risk + Cyber, we believe in defending the basic human right to security and privacy. We are looking for an exceptional Risk Advisory GRC Consultant to support the execution of Risk Advisory client engagements. This includes leading and executing relevant tasks, as well as assisting in developing service deliverables and internal processes that will drive value for the team and clients.

Our next team member will be authentic, articulate, and passionate about Cybersecurity, and will be unafraid to roll up their sleeves and dive deep into the unknowns, using their security expertise to identify opportunities to increase Echelon Risk + Cyber’s overall capabilities internally and for our clients.

At Echelon, you will have the opportunity to engage with systems at the cutting edge of technology. We allow our employees to build from the ground up and make an impact across the organization. We look for driven, proactive people eager to contribute to a distinct and thriving Cybersecurity services organization that can adapt to a rapidly changing environment.

This is a remote position from anywhere in the USA.

What You Will Do:

• Perform SOC 2 Type I/II readiness assessments and support attestation engagements, including scoping, control evaluation, gap identification, and remediation guidance
• Conduct ISO 27001 gap assessments, internal audits, and certification support engagements for clients across a range of industries and sizes
• Test and evaluate IT General Controls (ITGCs) across client environments, documenting findings and providing actionable remediation recommendations
• Support PCI DSS, HITRUST, HIPAA, and CMMC Level 2 compliance assessments as client workload requires
• Prepare and review audit workpapers, evidence requests, control narratives, and client-facing deliverables to a consistent standard of quality
• Work directly with clients to identify and assess information security risks, develop security policies and procedures, and provide practical remediation guidance
• Contribute to incident response planning, tabletop exercises, and business continuity engagements as part of Echelon’s broader advisory portfolio
• Manage multiple concurrent client engagements, balancing priorities and delivering quality results on schedule
• Build strong internal and client relationships through clear written and verbal communication, translating technical findings for both technical and non-technical audiences
• Stay current with evolving compliance frameworks, audit standards, and security threats to strengthen client services and internal methodologies
• Demonstrate thought leadership by creating content for the organization’s website and blog, and through involvement in the cybersecurity community

Do you have a valid CPA license?, Do you have a valid Certified Internal Auditor certification?, Do you have experience in Websites?, * 2-4 years of hands-on experience in IT audit, compliance, or GRC consulting, with a focus on SOC 2 Type I/II audits, ISO 27001 assessments, or related attestation engagements

• Demonstrated understanding of IT General Controls (ITGCs), Trust Services Criteria, and audit standards such as SSAE 18 or ISAE 3402, with additional exposure to incident response planning and business continuity concepts.
• Ability to conduct risk assessments, compliance reviews, and readiness evaluations across frameworks, including SOC 2, ISO 27001, PCI DSS, HITRUST, and HIPAA
• Strong analytical skills with the ability to identify and assess complex risk scenarios and offer practical solutions
• Familiarity with leading GRC tools and technologies to support compliance and risk management initiatives
• Excellent communication and presentation skills, capable of articulating technical concepts to technical and non-technical audiences
• Strong project management skills, including managing multiple engagements and deliverables simultaneously while maintaining high quality and client satisfaction standards
• Prior experience at a Big 4 firm, a mid-tier CPA/advisory firm, or a boutique IT audit/attestation firm is strongly preferred
• Applicants must have authorization to work in the United States without current or future visa sponsorship., * Already certified in, or currently pursuing, one or more of the following: CISA, CIA, CPA, CISSP, and/or ISO 27001 Lead Auditor
• Experience with the incident response lifecycle
• Experience developing project plans and timelines
• Track record of high-volume SOC 2 or ISO 27001 engagement delivery in a client-facing consulting or attestation role
• Exposure to FedRAMP, CMMC, or other government compliance frameworks

Pulled from the full job description

• 401(k)
• Health insurance
• Vision insurance
• Health savings account
• Dental insurance
• Flexible spending account
• Life insurance, We are committed to creating an inclusive environment for our team with unquestioned integrity. If you have a special need that requires accommodation, please let your recruiter know. One of our core values is “People with Personality,” and we want to allow you the space to bring your full self to work.

We currently offer the following benefits:

• Access to medical, dental, and vision insurance through Cigna, with the majority of the employee cost covered by the employer
• Employer funding to HSA accounts and FSA access
• Access to a 401(k) through Vanguard with a guaranteed employer contribution
• Flexible vacation policy that allows you to manage your schedule and rest and recharge when you need to.
• 11 holidays with flexibility based on what is important for you and those you love
• Employer-paid short-term and long-term disability, employer-paid life insurance, and access to additional life insurance, hospital coverage, accidental coverage, discounted mental health support, and more.
• Support for individual development through certifications, continued learning, conferences, and more