GRC Manager

Job Title: GRC Manager

Location: Remote

Mode Of Hire: Contract

Key Responsibilities

Control Testing & Assessment Execution (NIST SP 800-53 Aligned)

• Execute design and operating effectiveness testing aligned to NIST SP 800-53, using a structured, repeatable, and assessor-driven methodology.
• Apply NIST SP 800-53 controls by understanding control intent and risk objectives, rather than relying on control memorization or control-family sequencing.
• Clearly articulate and apply a generic control testing approach, including:
  • Interpreting NIST SP 800-53 control intent and expected outcomes
  • Defining assessment scope and identifying the appropriate population (systems, users, processes)
  • Determining sufficient and appropriate evidence to support NIST SP 800-53 control requirements
  • Validating evidence for accuracy, completeness, and relevance
  • Corroborating evidence across people, process, and technology
  • Documenting results, gaps, and conclusions in an audit-defensible manner
• Perform control walkthroughs, sampling, and validation across cybersecurity, IT, and operational control domains mapped to NIST SP 800-53.
• Support assessments in regulated environments where NIST SP 800-53 is the authoritative control baseline, while maintaining a framework-agnostic testing mind-set.

Evidence Validation & Professional Scepticism

• Request, track, and critically validate evidence provided by stakeholders.
• Challenge assumptions such as:
  • This applies to all users/systems
  • Everyone completed training
  • This report covers the full scope
• Validate:
  • Population completeness
  • System and environment coverage
  • Source-of-truth systems
  • Data consistency across multiple evidence sources

Audit, Risk & Issue Identification

• Identify control gaps even when evidence appears correct on the surface.
• Understand and apply:
  • Sampling vs. full population testing
  • Control design vs. operating effectiveness
  • Risk impact of control failures
• Clearly document issues, risks, and supporting rationale.
• Support remediation tracking and validation of corrective actions.

Cybersecurity & Technical Control Understanding (Practical)

• Demonstrate working knowledge of:
  • Network security controls
  • IT general controls
  • Technical cybersecurity controls
• Validate technical evidence such as:
  • Firewall rules and configurations
  • Access control listings and logs
  • Network diagrams and architecture artefacts
• Ask the right questions of technical teams to determine whether evidence truly supports the control.

Audit Communication & Stakeholder Interaction

• Explain testing approach, conclusions, and gaps clearly and logically.
• Provide structured, concise responses (typically within 5 10 minutes).
• Maintain a logical flow when walking through testing methodology and findings.
• Proactively follow up with stakeholders to close open items.
• Escalate risks, delays, or quality concerns to the onsite Lead SME.

Required Qualifications

• 8 12 years of experience in GRC, IT Audit, Cyber Risk, and Assurance roles.
• Strong working knowledge of NIST SP 800-53 controls.
• Hands-on experience with:
  • Control testing and evidence validation
  • Audit and assurance support
  • Cross-domain control environments
• Ability to explain a framework-independent control testing methodology
• Practical understanding of cybersecurity and IT control environments.
• Ability to explain a framework-independent control testing methodology.
• Strong written and verbal communication skills.
• Ability to work independently and manage multiple deliverables.

Preferred Qualifications

• Exposure to NIST SP 800-53, ISO 27001, NIST CSF, SOC, or SOX.
• Experience working with GRC tools for evidence and assessment tracking.
• Prior experience supporting large or regulated enterprise clients.

Key Competencies

• Strong execution and follow-up discipline.
• Structured and analytical approach to control assessment.
• Ability to work effectively in distributed delivery models.
• Assessor mind-set with strong professional scepticism.