SC Cleared GRC Controls & Oversight Lead

Role overview

Key responsibilities

• Lead and coordinate controls assurance and testing across IT and OT environments.
• Review and validate control effectiveness against policies, standards, and regulatory requirements.
• Identify control deficiencies, gaps, and improvements; drive timely remediation and follow-up.
• Manage assurance backlogs and prioritize outstanding actions and findings.
• Oversee risks, audit observations, control exceptions, and remediation plans.
• Gather evidence and validate compliance with security, operational, engineering, and business teams.
• Coordinate audit responses, evidence collection, and stakeholder engagement.
• Produce governance reports, assurance metrics, and updates for senior stakeholders.
• Align controls with organizational risk appetite, regulatory obligations, and industry good practice.
• Facilitate governance forums and risk reviews; support continuous improvement of governance and controls.

Essential experience and skills

• Experience in GRC, assurance, audit, controls, or oversight functions.
• Strong understanding of security and technology controls across IT and/or OT.
• Experience supporting control testing, assurance reviews, compliance assessments, or audits.
• Ability to analyze complex processes, identify weaknesses, and manage remediation actions.
• Strong stakeholder management, communication, organization, and attention to detail.
• Able to interpret policies, standards, procedures, and control requirements and work independently.

Desirable experience and qualifications

• Experience in critical national infrastructure, utilities, energy, manufacturing, or regulated environments is desirable.
• OT security and industrial control system knowledge is desirable.
• Familiarity with ISO 27001, NIST CSF, IEC 62443, NIS Regulations, or similar frameworks is desirable.
• GRC, audit, risk, or compliance management tool experience is desirable.
• A degree or equivalent professional experience in Information Security, Risk Management, Business Management, Technology, or a related discipline is required.
• CRISC, CISA, ISO 27001 Lead Auditor, CISSP, or equivalent certifications are advantageous but not essential.

Personal attributes