Qualifications:
Required
- 2 to 4 years of experience in cybersecurity, IT risk, IT audit, or compliance, with practical exposure to at least one GRC domain (risk management, compliance program management, policy governance, or third party risk)
- Experience supporting GRC work in one or more of the following areas:
- Risk Management: IT risk assessment support, risk register maintenance, qualitative risk scoring, and risk treatment tracking
- Compliance Program Management: gap assessment support, controls mapping, audit readiness activities, evidence collection, and remediation tracking against frameworks such as SOC 2, ISO 27001, HIPAA, PCI DSS, or SOX ITGC
- Policy & Control Governance: policy review and update cycles, mapping controls to frameworks (NIST, CIS, ISO), control testing support, and policy exception tracking
- Third Party & Vendor Risk: vendor assessment questionnaire administration, review of vendor responses and evidence, risk tiering support, and remediation tracking
- GRC Platforms: ServiceNow GRC, Archer, OneTrust, Vanta, Drata, or equivalent, as an end user or administrator maintaining records, running assessments, or building reports
- Foundational knowledge of common GRC and security frameworks, such as NIST CSF 2.0, NIST SP 800-53, ISO 27001/27002, CIS Controls v8, SOC 2 Trust Services Criteria, PCI DSS v4, HIPAA Security Rule, and SOX ITGC
- Understanding of core GRC concepts: risk identification and scoring, control design vs. control effectiveness, separation of duties, three lines of defense, the audit lifecycle, and data privacy principles
- Strong proficiency with Microsoft Excel, PowerPoint, and Word
Foundational consulting delivery competencies, including:
- Structured discovery: ability to support discovery interviews, take thorough notes, gather documentation and evidence, and organize information into clear, structured outputs
- Gap analysis: ability to compare documented controls and practices against framework requirements and clearly document gaps for team review
- Technical communication: ability to draft clear, accurate written findings and summaries, and to communicate status and questions concisely to the engagement team and client counterparts
- Workshop support: participate in discovery sessions, risk workshops, and working group meetings; help prepare materials and capture decisions and action items
- Deliverable quality: strong attention to detail and a track record of producing accurate, clearly organized work products on time and to standard
- Engagement collaboration: work effectively within project teams; communicate progress and blockers proactively to the engagement lead; adapt to shifting priorities and client needs
Preferred
- Bachelor’s degree in Information Security, Risk Management, Business, or a related field
- Industry certifications demonstrating security or GRC knowledge, such as Security+, ISC2 CC, SSCP, GRCP, or equivalent; progress toward CISA, CRISC, CISM, or CISSP is a plus, as are platform certifications from ServiceNow, OneTrust, or Archer
- Exposure to enterprise environments in financial services, healthcare, retail, manufacturing, or public sector, particularly where compliance is shaped by regulatory requirements (SOX, HIPAA, PCI DSS, DORA, FedRAMP)
- Prior experience at a professional services firm, audit firm, or systems integrator, or within an internal audit or compliance function
- Familiarity with additional frameworks and methods such as NIST RMF, COBIT, FedRAMP, DORA, or FAIR risk quantification
Key Competencies
- Foundational GRC knowledge and reliable execution of assigned work
- Attention to detail, delivery quality, and individual accountability
- Clear written and verbal communication
- Coachable, collaborative team contributor with a strong growth orientation
Success in this role means completing assigned GRC work accurately and on time, earning the trust of engagement leads and client teams through reliable performance, rapidly building domain knowledge and consulting skills, and contributing to a practice that clients trust and return to while building toward the skills and experience required to step into a Senior Consultant role.
Want to learn more about Consulting & Security Services? Check us out on our platform:
https://www.wwt.com/consulting-services
https://www.wwt.com/category/security-transformation
Certain states and localities require employers to post a reasonable estimate of salary range. A reasonable estimate of the current base pay range for this position is $82,800 to $103,500 annually. Actual salary will be based on a variety of factors, including shift, location, experience, skill set, performance, licensure and certification, and business needs. The range for this position in other geographic locations may differ. Certain positions may also be eligible for variable incentive compensation, such as bonuses or commissions, that is not included in the base pay.
The well-being of WWT employees is essential. When it comes to our benefits package, WWT has one of the best. We offer the following benefits to all full-time employees:
- Health and Wellbeing: Health (Medical & Prescription), Dental, and Vision Care, Onsite Health Centers (MO & IL), Employee Assistance Program, Wellness program
- Financial Benefits: Competitive Pay, Profit Sharing, 401k Plan with Company Matching, Life and Disability Insurance, Flexible Spending Accounts, Tuition Reimbursement
- Paid Time Off: PTO & Holidays, Parental Leave, Medical Leave, Military Leave, Bereavement, Day of Caring
- Additional Perks: Family Planning Benefits, Nursing Mothers Benefits, Voluntary Legal, Voluntary Supplemental Accident/Illness/Hospital, Voluntary ID Theft, Pet Insurance, Employee Discount Program
Note: This is not an all-encompassing list and should not be used as a complete description of the plan’s benefits. For more information, see our US benefits website at wwt.com/us-benefits.
We strive to create an environment where all employees are empowered to succeed based on their skills, performance, and dedication. Our goal is to cultivate a culture of belonging that encourages innovation, collaboration, and respect for all team members, ensuring that WWT
remains a great place to work for all!
If you require accessibility accommodation(s) or adjustment during any stage of the hiring process, please let your WWT Recruiter know. The recruiter will work with you to understand your needs and help ensure an accessible experience throughout the interview process.
World Wide Technology is an Equal Opportunity Employer.
If you have any questions or concerns about this posting, please email [email protected].
#LI-TB1
Preferred Qualifications
Why WWT?
World Wide Technology (WWT) strives to make a new world happen. WWT's work benefits clients and partners as much as it does its people and community across the globe.
Founded in 1990, WWT brings together strategy, deep technical expertise and world-class partnerships to help public and private sector organizations design, build and scale intelligent AI, digital, cybersecurity, cloud and infrastructure solutions. Through its Advanced Technology Center (ATC)—a collaborative ecosystem featuring state-of-the-art hardware and software—WWT enables clients and partners to conceptualize, test and validate innovative technology and then deploy solutions at scale using its global integration and distributions capabilities.
With more than 14,000 team members and over 60 locations globally, WWT's culture—grounded in core values and leadership philosophies—has been recognized by Fortune® and Great Place to Work for its commitment to innovation, trust and creating a great place to work for all. WWT provides products and services to large enterprise, global service provider and public sector clients in up to 130 countries across six continents. Softchoice, a World Wide Technology company, supports commercial and SMB markets in the U.S. and Canada.
Want to work with highly motivated individuals on high-performance teams? Join WWT today!
What is the Solutions Consulting & Engineering (SC&E) Team and why join?
Solutions Consulting & Engineering is an organization that is Customer Focused and Solutions Led. We deliver end-to-end and emerging solutions to drive customer satisfaction, increase profitability and growth. Our success is enabled by our world-class management consulting, delivery excellence and engineering brilliance. Our goal is to bring together business acumen with full-stack technical know-how to develop innovative solutions for our clients' most complex challenges.
Position Overview:
The Cyber Risk and Strategy Consultant is an individual contributor who executes assigned delivery tasks within WWT’s Governance, Risk, Strategy and Compliance practice. Positioned below the Senior Consultant, the Consultant builds practical knowledge across GRC domains, contributes to high quality client deliverables under the guidance of experienced team members, and develops the core consulting skills needed to grow within the practice.
The Consultant is a core contributor to GRC delivery, supporting risk assessments and compliance gap analyses, gathering and organizing evidence, reviewing policies and controls, and producing the documentation and analysis that inform client recommendations. They work under the direction of a Senior Consultant, Lead Consultant, or Senior Manager, and are expected to grow steadily toward greater independence and ownership of defined workstream components.
Essential Functions:
Engagement Delivery
- Execute assigned delivery tasks within GRC engagements under the direction of a Senior or Lead Consultant, with accountability for quality, accuracy, and timely completion
- Support GRC assessments: assist with current state discovery, gather and organize documentation and evidence, review control environments, document findings, and support maturity scoring against defined frameworks
- Perform core GRC work with guidance: populate and maintain risk registers, map controls and identify gaps against frameworks, support policy review and drafting, assist with compliance readiness assessments, and help evaluate third party risk
- Draft sections of client deliverables (assessment findings, risk registers, control gap registers, maturity scorecards, and executive summary inputs) for Senior and Lead Consultant review, meeting WWT’s professional services quality standards
- Participate in discovery sessions, stakeholder interviews, and workshops; capture detailed notes, track action items, and organize findings into structured outputs for team review
- Support strategy and program design activities: research regulatory and framework requirements, document current state compliance posture, and contribute analysis to future state program recommendations developed by senior team members
Client Engagement
- Build effective working relationships with client team members and project stakeholders; establish a reputation for responsiveness, reliability, and accuracy
- Communicate status, findings, and open questions clearly and accurately to client counterparts; begin developing the ability to walk through findings in client working sessions
- Support client status reporting, meeting coordination, documentation, and action item tracking under the direction of the engagement lead
Pursuit & Practice Support
- Support pursuit activities as assigned: research client environments and regulatory requirements, and contribute draft content to proposals and SOWs
- Contribute to practice development by helping build and maintain reusable delivery assets, assessment templates, control libraries, and knowledge base content
- Develop commercial awareness: learn how engagements are scoped, staffed, and delivered, including utilization expectations and how delivery quality connects to client satisfaction
Growth & Development
- Actively build foundational knowledge across GRC domains and regulatory frameworks through project work, training, certifications, and independent learning
- Seek and apply feedback from Senior Consultants, Lead Consultants, and Senior Managers; demonstrate consistent growth in delivery quality, independence, and communication skills
- Learn and consistently apply WWT delivery methodologies, tools, and quality standards
Skills Required
- 2 to 4 years of experience in cybersecurity, IT risk, IT audit, or compliance
- Practical exposure to at least one GRC domain, including risk management, compliance program management, policy governance, or third-party risk
- Experience supporting GRC work such as risk assessments, risk register maintenance, control mapping, audit readiness, evidence collection, remediation tracking, policy governance, control testing, or vendor risk assessments
- Experience using a GRC platform such as ServiceNow GRC, Archer, OneTrust, Vanta, Drata, or equivalent
- Foundational knowledge of GRC and security frameworks including NIST CSF 2.0, NIST SP 800-53, ISO 27001/27002, CIS Controls v8, SOC 2, PCI DSS v4, HIPAA Security Rule, and SOX ITGC
- Understanding of risk identification and scoring, control design and effectiveness, separation of duties, three lines of defense, audit lifecycle, and data privacy principles
- Strong proficiency with Microsoft Excel, PowerPoint, and Word
- Ability to support discovery interviews, gather documentation and evidence, and organize structured outputs
- Ability to perform gap analysis against framework requirements and document control gaps
- Clear technical writing and concise verbal communication
- Ability to participate in workshops, risk sessions, and working group meetings while tracking decisions and action items
- Strong attention to detail and ability to produce accurate deliverables on time
- Ability to collaborate on project teams, communicate progress and blockers, and adapt to changing client needs
- Bachelor's degree in Information Security, Risk Management, Business, or a related field
- Security or GRC certification such as Security+, ISC2 CC, SSCP, or GRCP
- Progress toward CISA, CRISC, CISM, or CISSP
- ServiceNow, OneTrust, or Archer platform certification
- Exposure to enterprise environments in financial services, healthcare, retail, manufacturing, or the public sector
- Prior experience at a professional services firm, audit firm, systems integrator, internal audit function, or compliance function
- Familiarity with NIST RMF, COBIT, FedRAMP, DORA, or FAIR risk quantification
