IT Risk Consultant, Cloud/SaaS Adoption

Infinitive is a data & AI consultancy that enables global brands to deliver results through insights, innovation, and efficiency. We possess deep industry and technology expertise to drive and sustain adoption of new capabilities. We match our people and personalities to our clients' culture while bringing the right mix of talent and skills to enable high return on investment.

Infinitive has been named “Best Small Firms to Work For” by Consulting Magazine eight times, and has also been named a Washington Post Top Workplace, Washington Business Journal Best Places to Work, and Virginia Business Best Places to Work.
 

We are seeking a Cloud / SaaS Service Adoption Risk Consultant to support clients in evaluating the security, compliance, operational, and business risks associated with onboarding and scaling new cloud and SaaS services. In this role, you will assess inherent risk, analyze controls, identify gaps, and produce clear, well-reasoned recommendations. This role requires cloud technical literacy, risk/control evaluation, structured thinking, and strong documentation skills.

• Understanding of the inherent risks associated with service types (IAM, compute, storage, networking, API's, logging, encryption)
• Describe best-practice configurations and expected safeguards at a high level
• Identify misconfigurations and explain why they introduce risk
• Apply secure-by-design principles and control frameworks to new services
• Reason through technical scenarios logically and clearly communicating implications

• Develop or refine cloud/SaaS adoption frameworks, intake workflows, risk scoring models, and tiering methodologies.
• ​​​​​​​Ensure adoption decisions align with enterprise policies (e.g., authentication standards, encryption requirements, data retention, vendor onboarding).
• Partner with enterprise architecture to confirm alignment with security patterns and integration standards.

• Facilitate risk review meetings across InfoSec, Legal, Procurement, Privacy, Architecture, and business stakeholders.
• ​​​​​​​Translate technical and compliance findings into clear business impact and decision options.

• Present recommendations to leadership and risk committees as needed.

• Create playbooks, intake checklists, vendor assessment templates, and decision dashboards.
• ​​​​​​​Identify opportunities to streamline review timelines and improve cross-team collaboration.
• Track adoption outcomes, continuous monitoring results, and vendor performance over time.

• 4+ years in one or more areas: cloud security, third-party risk, SaaS vendor evaluations, cybersecurity consulting, or enterprise technology risk management.

• Experience reviewing vendor security documentation (SOC reports, CAIQ/CSA, ISO 27001, FedRAMP packages, etc.).

• Familiarity with cloud concepts including identity and access management, data residency, integrations, audit logging, and API-driven workflows.

• Strong communication and stakeholder facilitation skills—able to synthesize and present risk recommendations clearly.

• Ability to manage multiple vendor/service assessments in parallel.

• Experience working within regulated industries (financial services, healthcare, public sector, etc.).

• Understanding of frameworks such as NIST CSF, ISO 27001, SOC, CSA CCM/STAR.

• Certifications such as CISA, CCSK/CCSP, Security+, CISM, CRISC, AWS/Azure/GCP Associate Level Certifications, or Prosci Change Management.

• Prior consulting or cross-functional advisory experience.