Principal Cybersecurity GRC Architect - (CISSP, CISM, CISA, CRISC, ISO 27001 Lead Auditorv) (Onsite / Contract)

Principal GRC, Cyber Security Data Architect

SAN FRANCISCO, CA

Duration: 06+ months

Lead the delivery of a NIST CSF 2.0 cybersecurity gap and maturity assessment for a global enterprise program, covering assessment planning, stakeholder engagement, evidence review, maturity scoring, risk based gap prioritization, executive reporting, and development of a practical improvement roadmap.

Key Responsibilities

• Own end to end engagement governance, project planning, milestones, risks, dependencies, status reporting, and stakeholder communications.
• Conduct NIST CSF 2.0 maturity assessment across functions, categories, subcategories, implementation tiers, and profiles.
• Review policies, standards, procedures, controls, risk registers, asset inventories, KPIs/KRIs, and supporting evidence.
• Facilitate interviews and workshops with cybersecurity, risk, compliance, technology, and business stakeholders.
• Define defensible maturity scoring, identify control gaps, assess business risk, and prioritize remediation actions.
• Develop executive ready assessment reports, maturity dashboards, prioritized recommendations, and near/mid/long term roadmap.

Required Experience

Required Skills

• Strong expertise in NIST CSF 2.0, cybersecurity governance, risk management, compliance, control maturity models, and ISO 27001 / ISMS.
• Ability to map controls across NIST CSF, ISO 27001, NIST 800 53, CIS Controls, SOC 2, and similar frameworks.
• Experience in evidence based assessment, maturity scoring, risk based gap prioritization, and remediation roadmap development.
• Excellent consulting delivery, workshop facilitation, stakeholder management, executive reporting, and written/verbal communication skills.

Preferred Certifications

• CISSP, CISM, CISA, CRISC, ISO 27001 Lead Auditor / Lead Implementer, NIST CSF training/certification, PMP / Prince2 / Agile certification preferred.

Tools / Platforms Knowledge Preferred

• GRC and evidence management platforms such as Archer, ServiceNow GRC, OneTrust, MetricStream, SharePoint, Teams, Excel, PowerPoint, Visio, Power BI, and cybersecurity KPI/KRI dashboarding tools.