GRC Policy & Standards Specialist

Job Description – GRC Policy & Standards Specialist
Experience: 6–10 years
Level: Mid-Level / Senior Consultant
Role: GRC Policy, Standards & Governance Consultant
Role Overview
• We are looking for a strong GRC Policy & Standards Specialist to develop, enhance, and 
operationalize enterprise governance documentation across security, technology, risk, 
and operational functions.
• The successful candidate will have demonstrated experience developing enterprise 
policies, standards, control requirements, procedures, and supporting governance 
documentation that are clear, structured, actionable, and aligned with recognized 
regulatory and industry frameworks.
• This role requires more than strong writing skills. The individual must understand what 
constitutes effective GRC documentation, including appropriate distinctions between 
policies, standards, procedures, controls, and guidelines, and be able to translate 
complex regulatory, risk, security, technology, and operational requirements into 
documentation that can be practically implemented.
• A critical part of the role will be working across organizational boundaries. The 
individual must be comfortable engaging with technology, cybersecurity, operations, 
risk, compliance, legal, and business stakeholders, reconciling different perspectives, 
challenging unclear requirements, and driving documentation through review, approval, 
and adoption.
Key Responsibilities
• Lead the development, review, and enhancement of enterprise GRC policies, 
standards, procedures, control requirements, and governance documentation.
• Establish consistent documentation structures, terminology, requirements language, 
and governance conventions across policies and standards.
• Translate regulatory, risk, security, technology, and business requirements into clear, 
enforceable, and operationally practical policy and standards requirements.
• Ensure appropriate distinction and traceability between policy statements, standards 
requirements, control objectives, procedures, and supporting guidance.
• Work directly with subject matter experts across technology, cybersecurity, operations, 
risk, compliance, legal, privacy, and business functions to develop and validate 
requirements.
• Facilitate working sessions and stakeholder reviews to identify requirements, resolve 
conflicting requirements, close documentation gaps, and achieve agreement on 
governance expectations.
• Convert complex technical requirements into language that can be understood by 
business and operational stakeholders while maintaining sufficient specificity for 
technology and control owners.
• Ensure policy and standards requirements are written in a manner that is measurable, 
auditable, and capable of being translated into controls and operational processes.
• Support the mapping of policies and standards to regulatory obligations, control 
frameworks, risks, and enterprise requirements.
• Partner with control owners and operational teams to ensure documented 
requirements can be realistically implemented and evidenced.
• Identify gaps between documented requirements and current operational or 
technology practices and help define appropriate remediation actions.
Required Experience
• 6–10 years of experience across policy governance, GRC, cybersecurity governance, 
compliance, technology and enterprise risk.
• Demonstrated experience authoring and substantially revising enterprise policies and 
standards, rather than solely reviewing documentation created by others.
• Strong understanding of what constitutes effective and enforceable GRC and 
governance documentation.
• Ability to write requirements that are clear, concise, enforceable, testable, and 
appropriately prescriptive.
• Strong understanding of GRC concepts including risk management, control design, 
compliance, assurance, issue management, exceptions, and governance oversight.
• Ability to understand technical concepts and work effectively with technology, 
architecture, engineering, cybersecurity, and IT operations teams without needing to be 
a hands-on engineer.
• Ability to work with operational and business stakeholders to understand processes, 
identify practical requirement gaps, and ensure governance requirements are usable 
outside of GRC.
• Experience translating regulatory, framework, security, or risk requirements into 
enterprise policy, standards, and control language.
• Strong stakeholder management skills, including the ability to facilitate discussions 
involving management-level+ stakeholders.
• Excellent written communication, editing, analytical, and information-structuring skills.
• Strong attention to detail and ability to identify ambiguous language, inconsistent 
requirements, documentation gaps, and conflicting governance expectations.
• Confidence working directly with senior leaders, subject matter experts, control 
owners, and second-line risk and compliance functions.
Preferred Experience
Experience with several of the following would be valuable:
• NIST CSF / NIST 800-series
• ISO/IEC 27001 and 27002
• ISO/IEC 42001
• NIST AI RMF
• SOC 2
• Privacy and data governance frameworks
• Third-party risk management
• Secure software development and technology governance
• Cloud and infrastructure security standards
• AI and emerging technology governance
• Regulatory compliance frameworks
• GRC platforms and policy management tools
Most Important Profile
• We are not looking for a technical writer who simply documents information provided 
by subject matter experts, nor are we looking for a purely technical security or 
engineering resource.
• We need someone who understands governance, risk, controls, and enterprise policy 
architecture and can independently determine what strong policy and standards 
documentation should look like.
• The ideal candidate can sit with a cybersecurity architect, technology leader, 
operational process owner, risk professional, or compliance SME; understand their 
requirements; challenge ambiguity or impractical expectations; and translate those 
discussions into clear, defensible, implementable, and auditable enterprise 
requirements.
• Strong candidates should be able to operate as both a governance subject matter 
expert and a skilled policy author, while effectively navigating stakeholders across 
business, operations, risk, security, and technology