Cyber Security Consultant

Our Client, a Global Investment Bank, is seeking a Cyber Security Consultant in their New York, NY location.

Responsibilities:

• Perform detailed cybersecurity risk assessments for applications, ensuring alignment with Governance, Risk, and Compliance (GRC) frameworks.
• Recommend and evaluate security controls across various domains, including IAM, endpoint security, network security, application security, cloud security, vulnerability management, configuration management, and DLP controls.
• Review and provide advisory on security architecture design documents to ensure compliance with organizational and regulatory standards.
• Assess and document compliance with bank security policies, procedures, and controls while identifying gaps and providing actionable recommendations to stakeholders.
• Support GRC initiatives by aligning risk assessments with enterprise risk management and regulatory compliance requirements.
• Collaborate with team members but demonstrate the ability to work independently on most projects.
• Evaluate and validate evidence (e.g., policies, reports, and procedures) regarding security controls, testing, and GRC metrics.
• Communicate identified risks, including their business impact, to stakeholders and provide recommendations for mitigation strategies.
• Prepare and present risk assessment findings and GRC reports to management and relevant committees.
• Conduct and document third-party vendor security risk assessments, ensuring alignment with GRC frameworks, and work with relationship managers to address critical and high-risk issues.
• Ensure compliance with enterprise policies, procedures, and applicable regulatory requirements.
• Support GRC reporting processes, including the creation of dashboards and key performance indicators (KPIs).

Must-Have Skills/Requirements:

• Cybersecurity and GRC Experience: 5–8 years of IT security analysis experience, with hands-on involvement in GRC frameworks and tools.
• Threat and Risk Assessment Expertise: Proven experience conducting cybersecurity threat and risk assessments, incorporating GRC principles, with at least one project within the past 3 years.

Technical Knowledge:

• Strong understanding of security controls and mechanisms across IT environments.
• Experience with GRC tools and platforms to document and manage risks, policies, and compliance activities.
• Familiarity with regulatory requirements, such as GDPR, CCPA, PCI DSS, and SOX.
• MS Office Proficiency: Advanced knowledge of MS Office, with a strong preference for extended experience in MS Excel (e.g., pivot tables, macros).

Key Skills:

• Expertise in cybersecurity control testing and GRC integration.
• Familiarity with cybersecurity audit and risk management methodologies.
• Strong communication skills to translate technical findings into business impacts.
• Ability to prioritize assessments, manage tasks independently, and provide proactive updates to management.
• Detail-oriented, resourceful, and team-oriented with a professional attitude.

Nice-to-Have Skills:

• Experience in financial services, with a focus on regulatory compliance and GRC integration.
• Proficiency in advanced MS Excel functions and reporting.

Educational Qualifications:

• Bachelor’s or Master’s degree in IT, Cybersecurity, or a related field (preferred).
• CISSP certification (ISC2 Associate or fully certified) is required.
• Certifications related to GRC (e.g., CRISC, CISA, or CGEIT) are highly desirable.