Job Title: Governance and Compliance

Location: Remote

Duration: Full Time Permanent

Position purpose

Help client translate approved IT, cybersecurity, privacy, compliance, and operational policies into practical procedures and repeatable governance practices. The consultant clarifies accountability, documents workflows, defines evidence requirements, and supports consistent execution and compliance monitoring.

Principal responsibilities:

·        Policy and documentation review. Assess the policy inventory and its supporting standards, procedures, guidelines, and records. Identify missing, outdated, overlapping, or inconsistent documentation and prioritize procedure development by risk, audit needs, regulatory requirements, and operational dependencies.

·        Procedure development. Draft procedures for policy lifecycle and exceptions; identity lifecycle, privileged access, and access reviews; asset lifecycle; data handling; secure configuration and change management; and incident escalation and review.

·        Operational control processes. Develop procedures for third-party lifecycle and contract security review, continuity and recovery, backup monitoring and restoration testing, evidence collection, corrective actions, and regulatory, contractual, or audit request coordination.

·        Roles and accountability. Identify accountable business and technology owners. Develop responsibility assignments using RACI or a comparable model, clarify approvals and handoffs, and define escalation for overdue activities, control failures, policy violations, and accepted risks.

·        Workflow and control integration. Map procedures to policies and controls. Document steps, decisions, approvals, and evidence; identify opportunities to use existing ticketing, GRC, or service-management platforms and future automation. Record unresolved process gaps and associated risks.

·        Compliance evidence. Create an evidence inventory covering owners, sources, collection frequency, retention requirements, and storage locations. Recommend repository organization and repeatable collection and validation procedures, and identify evidence gaps affecting reviews or audits.

·        Governance and reporting. Establish a recurring stakeholder cadence and maintain procedure-development and remediation trackers. Define practical performance indicators and an executive reporting format covering deliverables, risks, dependencies, overdue actions, and decisions needed.

·        Knowledge transfer. Facilitate validation and working sessions with process owners, incorporate feedback, explain evidence and escalation expectations, and provide guidance for continued procedure review, maintenance, and program transition.

Expected work products

·        Work products are prioritized with client and completed within the agreed scope and available engagement hours.

·        Policy and procedure gap analysis with a prioritized procedure-development backlog.

·        Procedure documents, workflow descriptions, policy-to-control mappings, and RACI or comparable responsibility assignments.

·        Evidence inventory, repository recommendations, collection and validation procedures, and corrective-action tracking practices.

·        GRC status-reporting format, performance indicators, procedure and remediation trackers, and process-owner handoff materials.

Qualifications and capabilities

·        Demonstrated experience in IT governance, risk, compliance, cybersecurity process documentation, or control assurance.

·        Ability to translate policy requirements into usable procedures, workflows, accountability assignments, and evidence expectations.

·        Understanding of access management, asset and data lifecycle, change control, incident response, third-party risk, and continuity processes.

·        Strong technical writing, workshop facilitation, audit-evidence organization, and action-tracking skills; familiarity with GRC or service-management platforms is beneficial.

Working relationships

·        Coordinate priorities with ’s designated sponsor, CIO, and process owners. Work with IT, Security, Human Resources, Legal, Compliance, Privacy, Finance, Procurement, and other operational functions to validate responsibilities and dependencies. Process owners review the documentation and remain accountable for executing their controls.

Scope and authority

·        The assignment provides advisory, documentation, and process-development support. Technical implementation, engineering, configuration, or operational support outside the advisory scope requires separate written authorization. retains responsibility for implementation, remediation, risk decisions, and ongoing operation of its processes and controls.

·        Performance expectations

·        Assess contribution through usable procedures validated with owners, clear accountability and evidence requirements, current trackers, and effective knowledge transfer. Agreed priorities and schedules depend on available capacity, stakeholder participation, access to documentation, and timely feedback.