Cybersecurity GRC Consultant - CMMC, FedRAMP & Security Compliance.
Role Overview
We are looking for a hands-on Cybersecurity GRC Consultant with strong experience in CMMC, FedRAMP, NIST, SOC 2, ISO 27001 and/or HITRUST to lead and deliver cybersecurity compliance and advisory engagements.
The role requires practical experience in control assessment, framework mapping, evidence validation, gap assessment, risk analysis, remediation advisory and audit/report delivery.
This is a delivery-focused consulting role requiring both technical understanding and solid client-facing capabilities.
Key Responsibilities
• Lead end-to-end cybersecurity GRC and compliance engagements, including scoping, planning, assessment, evidence review, gap analysis, remediation support and final reporting.
• Perform assessments against CMMC 2.0, FedRAMP, NIST SP 800-171, NIST SP 800-53, ISO 27001, SOC 2 and HITRUST CSF, based on client requirements.
• Develop and maintain control mappings and crosswalks across CMMC, FedRAMP, NIST, ISO 27001, SOC 2 and HITRUST.
• Conduct detailed control design and operating effectiveness assessments, including review of policies, procedures, configurations, records and other audit evidence.
• Evaluate control gaps, determine risk and impact, and develop practical remediation recommendations.
• Support clients in defining and documenting security controls, policies, procedures, control narratives and evidence requirements.
• Develop and/or review System Security Plans (SSPs), Plans of Action & Milestones (POA&Ms;), risk assessments, Statements of Applicability, control matrices and audit workpapers.
• Support SOC 2 readiness and Type I/Type II assessment activities, including Trust Services Criteria mapping, control testing and evidence evaluation.
• Support ISO 27001 implementation/readiness/certification and surveillance activities, including ISMS controls, risk treatment and Statement of Applicability.
• Support HITRUST CSF readiness and validated asse
📌 SISA Information Security (Mumbai)
🏢 SISA
📍 Mumbai