Location: Austin, TX
Employment Type: Direct Hire / Full-Time
Work Arrangement: Onsite
Work Authorization: U.S. Citizen or Green Card Holder required
Our client is seeking an experienced Cybersecurity Governance, Risk & Compliance (GRC) Specialist II to join its Information Security organization in Austin.
This position is ideal for a cybersecurity professional who has done more than participate in audits, complete compliance checklists, or respond to security questionnaires. The successful candidate will have hands-on experience with cybersecurity governance and risk management and will understand how security programs are structured, governed, measured, and improved within a complex organization.
While compliance is an important component of the position, the strongest emphasis is on Governance and Risk. Candidates should be comfortable discussing how cybersecurity decisions are made, how accountability and ownership are established, how risk is identified and evaluated, and how policies, standards, exceptions, and risk-treatment decisions are managed across an organization.
What You'll Be Doing
Cybersecurity Governance
- Help operate and mature the organization's cybersecurity governance program.
- Develop, maintain, and improve information security policies, standards, procedures, and governance documentation.
- Work with security, technology, business, and leadership teams to establish clear ownership and accountability for cybersecurity requirements.
- Help ensure security policies and standards translate into practical controls and operating processes.
- Provide guidance to stakeholders on security requirements, governance processes, and appropriate security practices.
- Identify gaps between established security requirements and actual business or technology practices and help drive appropriate remediation.
Cybersecurity Risk Management
- Perform and support cybersecurity risk assessments across technology, business processes, vendors, applications, and services.
- Identify security risks, assess their potential business impact, and communicate findings clearly to both technical and non-technical stakeholders.
- Work with risk owners to determine appropriate remediation, mitigation, acceptance, transfer, or other risk-treatment strategies.
- Manage and evaluate security exception requests and help ensure accepted risks have appropriate ownership, documentation, approvals, and expiration or review dates.
- Track identified risks and remediation activities through resolution.
- Help leadership understand cybersecurity risk so informed business decisions can be made.
Third-Party & Client Security
- Conduct security reviews and risk assessments of vendors and third-party service providers.
- Manage remediation and follow-up activities associated with identified vendor risks.
- Support the ongoing third-party security risk management lifecycle.
- Lead or coordinate responses to client security questionnaires, assessments, and security-related inquiries.
- Gather and validate evidence demonstrating the effectiveness of security controls.
- Participate in client and third-party discussions as an Information Security subject matter expert.
Security Controls & Frameworks
- Evaluate technology environments and security programs against established cybersecurity frameworks, standards, and internal requirements.
- Work with frameworks and assessment methodologies including NIST, ISO 27001, SOC, and SIG.
- Assess whether controls are appropriately designed, implemented, documented, and operating as intended.
- Partner with technology and security teams to address control gaps and strengthen the organization's overall security posture.
AI Governance & Risk
- Support governance and risk management associated with Artificial Intelligence technologies and use cases.
- Evaluate AI-related security, governance, privacy, and technology risks.
- Help establish appropriate controls, standards, and risk-management practices for responsible AI adoption.
- Work with stakeholders to evaluate new AI capabilities from a cybersecurity and risk perspective.
Security Awareness & GRC Operations
- Support and help manage the organization's Security Awareness program, including planning, training evaluation, measurement, and continuous improvement.
- Support administration and optimization of GRC platforms, workflows, reporting, and risk records.
- Maintain accurate documentation and reporting related to risks, controls, exceptions, assessments, and remediation activities.
- Help improve GRC processes as the cybersecurity program continues to mature.
What We're Looking For
Education & Experience
- Bachelor's degree or equivalent combination of education and experience.
- Approximately 5+ years of IT Security experience, including meaningful experience within cybersecurity governance, risk, or GRC.
- At least 4 years of Information Security experience with exposure to technical security environments.
- Hands-on cybersecurity experience is strongly preferred.
Governance & Risk Experience – Critical
Candidates should be able to clearly explain their experience with:
- Cybersecurity governance structures and processes.
- Security policy and standards development.
- Roles, responsibilities, ownership, and accountability within a security program.
- Cybersecurity risk identification and assessment.
- Risk scoring, prioritization, remediation, and treatment.
- Risk acceptance and security exception processes.
- Translating technical security findings into business risk.
- Working with risk and control owners to drive issues through resolution.
We are particularly interested in candidates who understand why governance processes exist and how they influence cybersecurity decision-making, rather than candidates whose GRC experience has primarily consisted of compliance testing or audit support.
Additional Qualifications
- Strong working knowledge of NIST, ISO 27001, SOC, and SIG or comparable security frameworks and assessment methodologies.
- Experience performing third-party/vendor security assessments.
- Experience responding to client security questionnaires and security reviews.
- Experience with AI governance, AI security, or AI risk management.
- Strong technical writing skills with the ability to develop clear policies, standards, risk documentation, and executive-level communications.
- Experience working with GRC platforms and related workflow technologies.
- Understanding of role-based access controls and identity/security concepts.
- Working knowledge of security technologies and concepts such as authentication, encryption, firewalls, SIEM, IDS/IPS, vulnerability management, privileged access management, and mobile security.
- Ability to communicate cybersecurity risk effectively to both technical teams and business stakeholders.
- Strong analytical, organizational, project-management, and problem-solving skills.
Preferred certifications may include
CISSP, CISA, CISM, or relevant AI governance, audit, risk, or security credentials.
The Candidate We're Looking For
The right person will not view GRC as simply an audit or compliance function. We are looking for someone who understands that strong cybersecurity governance establishes how security decisions are made, who owns those decisions, how accountability is maintained, and how risk is evaluated and addressed.
You should be comfortable discussing real examples of situations where you identified a cybersecurity risk, worked with stakeholders to determine an appropriate response, documented or communicated that risk, and followed the issue through remediation or formal acceptance.
This is a highly collaborative position requiring the ability to work effectively with cybersecurity professionals, engineers, technology teams, business leaders, vendors, and clients.
This is a full-time, direct-hire position requiring onsite work in Austin. Candidates must be U.S. Citizens or Green Card holders.
How to Apply:
Our client has hired us to help facilitate the initial interview and recruiting process. Please attach your current version of your resume and make sure you complete our initial pre-screening questions that will be used for determining which applicants will be considered at this time. Thank you for your interest.