Business Consultant - Security & Governance Specialist

Role: Business Consultant - Security & Governance Specialist

Client Location: Westlake, Texas/ Durham, NC (Hybrid)

Type: Contract

Role Summary:

• We are seeking an experienced Security & Governance Specialist to support enterprise cybersecurity, technology risk, and governance initiatives in close collaboration with TISO (Technology/Technical Information Security Officer), CISO, Technology, Risk, Compliance, and Audit teams.
• The ideal candidate should have strong experience in data classification, threat modeling, vulnerability management, security controls, risk assessments, and control evidence management. The role will help ensure technology solutions comply with organizational security policies, regulatory requirements, and established risk management frameworks.

Day to Day Job Duties:

• Partner with TISO and CISO organizations to implement and maintain security governance and technology risk requirements.
• Conduct security and technology risk assessments for applications, platforms, cloud services, and infrastructure.
• Support data classification and ensure appropriate security controls are applied based on data sensitivity.
• Facilitate and document threat modeling exercises to identify potential security threats and recommend mitigating controls.
• Identify, assess, track, and report application and infrastructure vulnerabilities through remediation and closure.
• Coordinate with engineering, infrastructure, cloud, and application teams to drive timely vulnerability remediation.
• Collect, validate, and maintain security control evidence for audits, assessments, and regulatory reviews.
• Assess security controls and identify gaps against organizational policies and applicable security frameworks.
• Maintain risk registers and track security risks, exceptions, remediation plans, and mitigating controls.
• Support security reviews for new applications, architecture changes, cloud implementations, and production releases.
• Monitor security findings, remediation timelines, control effectiveness, and risk acceptance activities.
• Prepare security governance dashboards, risk reports, metrics, and executive-level status updates.
• Support internal/external audits and regulatory examinations by coordinating evidence and remediation responses.
• Collaborate with TISO/CISO, Engineering, Architecture, DevOps, and business stakeholders to embed security throughout the technology lifecycle.

Basic Qualifications:

• 7+ years of experience in Cybersecurity, Information Security, Technology Risk, or Security Governance.
• 5+ years of experience with security risk assessments, control assessments, audit evidence, and security governance.
• 4+ years of experience with vulnerability management, remediation tracking, and security risk management.
• 3+ years of experience with data classification, threat modeling, and application/cloud security assessments.

Nice to Have:

• Experience working directly with TISO/CISO organizations and senior security leadership.
• Knowledge of security frameworks such as NIST CSF, ISO 27001, CIS Controls, or similar frameworks.
• Experience with cloud security across AWS and/or Microsoft Azure.
• Understanding of application security, API security, IAM, encryption, secrets management, and secure engineering.
• Experience with vulnerability management tools such as Qualys, Tenable, Rapid7, or similar platforms.
• Familiarity with GRC platforms such as ServiceNow IRM/GRC or Archer.
• Knowledge of DevSecOps and secure SDLC practices.
• Experience supporting regulatory, internal audit, and external audit requirements.
• Experience in Banking, Financial Services, or other highly regulated enterprise environments.
• Security certifications such as CISSP, CISM, CRISC, CCSP, or ISO 27001 are preferred.
• Strong analytical, stakeholder management, communication, documentation, and risk-management skills