GRC Consultant

The successful candidate will provide subject matter expertise across information security governance, regulatory compliance, risk management, audit readiness, third-party risk management, business continuity, and operational resilience. The role requires strong stakeholder management skills and the ability to present complex risk and compliance matters to both technical and executive audiences.

Key Responsibilities:

Governance & Compliance:

• Lead the development, maintenance, and continuous improvement of governance frameworks, policies, standards, and procedures.
• Support compliance with industry standards and regulatory requirements, including ISO 27001, SOC 1, SOC 2, PCI DSS, PCI PIN Security, data localisation requirements, and other applicable frameworks.
• Conduct compliance assessments, gap analyses, and maturity reviews, identifying opportunities for control enhancement and process improvement.
• Coordinate internal and external audits and support remediation of identified findings.

Risk Management:

• Facilitate enterprise, operational, technology, and cybersecurity risk assessments.
• Maintain risk registers and support risk treatment, monitoring, and reporting activities.
• Collaborate with stakeholders to implement effective mitigation strategies and monitor risk exposure.
• Prepare executive-level risk reporting and dashboards to support leadership decision-making.

Client & Regulatory Assurance:

• Support security due diligence activities, client assessments, and assurance requests from financial institutions, partners, regulators, and payment networks.
• Coordinate responses to regulatory inquiries and examinations.
• Engage directly with clients and external stakeholders to communicate Pismo's security, compliance, and resilience capabilities.
• Prepare reports, executive summaries, and evidence packages for customer and regulatory reviews

Strategic Initiatives:

• Drive continuous improvement initiatives through automation, AI-enabled processes, and operational efficiency programmes.
• Support the implementation of new compliance and security initiatives resulting from regulatory or business changes.
• Contribute to organisational security awareness and compliance maturity programmes.
• Mentor junior GRC professionals and contribute to knowledge sharing across the organisation

This is a remote position. A remote position does not require job duties be performed within proximity of a Visa office location. Remote positions may be required to be present at a Visa office with scheduled notice.

Qualifications

Basic Qualifications:

• 5 years relevant work experience with a Bachelor's degree or 2 years relevant work experience with an Advanced degree (e.g. Masters, MBA, JD, MD) or 0 years relevant work experience with a PhD; OR 8 years relevant work experience

Preferred Qualifications:

• Bachelor's degree in Information Security, Cybersecurity, Risk Management, Information Technology, Law, Business Administration, or a related field.
• Minimum 5 years of experience in Governance, Risk & Compliance, Information Security, Risk Management, Internal Audit, or related consulting roles.
• Demonstrated experience supporting audits, regulatory reviews, or certification programmes.
• Strong understanding of risk management methodologies and information security governance principles.
• Experience interacting with senior stakeholders and executive leadership.
• Strong analytical, communication, presentation, and report-writing skills.
• Professional certifications such as:

• CISSP
• CISM
• CISA
• CRISC
• ISO 27001 Lead Auditor or Lead Implementer
• CGRC

• Experience in banking, payments, fintech, or other highly regulated industries.
• Familiarity with cloud-native environments and modern software development practices.
• Knowledge of privacy and data protection regulations.

Visa is an EEO Employer

Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability or protected veteran status. Visa will also consider for employment qualified applicants with criminal histories in a manner consistent with EEOC guidelines and applicable local law.