GRC Consultant

The GRC Implementation Consultant is responsible for planning, designing, implementing, and maturing Governance, Risk, and Compliance frameworks for the clients. This role liaises with business units, IT, auditors, and leadership to identify and deploy policies, controls, risk assessments, compliance programs, and GRC tool. The consultant ensures that regulatory, industry, and internal compliance requirements are translated into actionable controls and measurable outcomes. 

Key Responsibilities:

1. GRC Framework Implementation

• Lead end-to-end implementation of GRC programs based on frameworks such as ISO 27001, ISO22301 and local regulations (e.g., UAE IA, TDRA, CSC, NCEMA).
• Develop and deploy governance structures, policies, standards, and procedures.
• Facilitate risk assessments (operational, IT, cybersecurity, vendor risk).
• Map risks to controls and recommend risk treatment plans.

2. Compliance & Audit Management

• Implement and monitor compliance programs to ensure adherence to regulatory and internal requirements.
• Conduct control assessments, maturity assessments, and internal audits.
• Support external audits by preparing evidence, documentation, and remediation plans.
• Track non-conformities, CAPA (Corrective Actions), and compliance KPIs.

3. GRC Tool Configuration & Automation

• Configure and customize the GRC platform.
• Design workflows for risk registers, issue management, control testing, policy lifecycle management, and exception handling.
• Generate dashboards and automated reports for leadership.

4. Risk Management Activities

• Run enterprise, IT, cybersecurity, and vendor risk assessments.
• Maintain and update the enterprise risk register.
• Analyze threats, vulnerabilities, impact, and likelihood to calculate risk scores.
• Provide recommendations to mitigate or optimize risks.

5. Stakeholder Engagement & Advisory

• Conduct workshops, awareness sessions, and training for process owners.
• Collaborate with IT, Business, HR, Legal, Operations, and external auditors.
• Serve as a subject matter advisor on governance, cyber regulations, and best practices.

6. Documentation & Reporting

• Prepare detailed project documentation, implementation plans, and status reports.
• Develop SoPs, risk treatment plans, audit reports, and compliance dashboards.
• Report risk posture, compliance gaps, KRIs, and KPIs to management.

7. Project Management

• Manage the client engagement independently in terms of Project plan, deliverables and closure

Required Qualifications

• Bachelor’s degree in information security, IT, Risk Management, or related field.
• Certifications (Mandatory): ISO 27001 Lead Implementer or Lead Auditor
• Certifications (Preferred): ISO 22301 Lead Implementer or Lead Auditor
• CRISC / CISM / CISSP

Skills & Competencies

• Strong knowledge of GRC frameworks and regulatory requirements.
• Excellent documentation and presentation skills.
• Strong analytical and problem-solving abilities.
• Ability to manage multiple clients, stakeholders and projects.
• Experience conducting risk assessments and control design.
• Understanding cybersecurity, IT processes, and audit methodologies.

Experience Requirements:

• 3–8 years of experience in GRC implementation or consulting.
• Experience in implementing ISMS & BCMS on ISO 27001, ISO 22301, UAE IA, NCEMA or equivalent frameworks.
• Practical experience leading audits, assessments, and GRC tool deployments.
• Experience in government/regulatory environments (e.g., UAE IA, NCEMA) is an advantage.

Key Deliverables

• GRC framework implementation roadmap
• Policies, standards, and procedures
• Risk registers and treatment plans
• Compliance assessments and audit reports
• GRC tool dashboards, workflows, and automation
• Training and awareness sessions