Impress employers and recruiters.
Choose from hundreds of resume examples.

Target Resume Now

Tailor your resume to this GRC Audit & Assurance Consultant role.

Rezi rewrites your resume against NTT Ltd.'s job description. Free.

Resume score gauge reading 58 out of 100

Don't guess if your resume is good enough.

See how it scores against the GRC Audit & Assurance Consultant posting at NTT Ltd. — free, in seconds.

About the Role

The Lead GRC Consultant will lead and deliver governance, risk, compliance, and assurance activities across a complex cyber security programme. This role combines structured GRC assessment with evidence-led assurance, control and process review, gap assessment, remediation planning, and stakeholder engagement, working across IT and OT environments using frameworks like the NCSC Cyber Assessment Framework (CAF).

Responsibilities

Lead GRC assessment and assurance activities across the agreed programme scope, coordinating inputs from cyber security, risk, compliance, architecture, IT and OT stakeholders.
Perform evidence-led assurance by reviewing policies, standards, procedures, technical artefacts, operational records, risk information and other supporting evidence to determine whether stated controls and practices are demonstrably implemented.
Conduct structured gap assessments against agreed regulatory, contractual and security-framework requirements, including NCSC CAF/eCAF where applicable.
Review and challenge customer self-assessments, control assertions and supporting rationale, identifying supported, partially supported, unsupported or contradictory positions.
Assess governance arrangements, risk-management processes, control ownership, policy frameworks, assurance processes, evidence management and compliance reporting.
Facilitate interviews, workshops, walkthroughs and challenge sessions with business, technical and operational stakeholders.
Maintain clear traceability between requirements, controls, evidence, findings, risks, recommendations and remediation actions.
Distinguish between control deficiencies and evidence deficiencies, and clearly document assessment limitations or areas requiring further validation.
Develop evidence-based findings with clear criteria, observed condition, supporting evidence, risk/impact and proportionate recommendation.
Assess control design and, where sufficient evidence is available, operating effectiveness and sustainability of controls.
Consolidate assessment findings into maturity, gap and readiness views for senior stakeholders and programme governance.
Develop prioritised remediation recommendations, target control outcomes and evidence requirements, and support remediation planning and tracking.
Review remediation evidence and determine whether findings can be validated as addressed, partially addressed or remain open.
Contribute to executive reporting, audit/readiness reporting, regulatory preparation and management briefings.
Apply internal quality assurance and peer-review expectations to ensure conclusions are consistent, evidence-based and defensible.
Provide day-to-day leadership and direction to GRC assessors and supporting consultants.
Allocate assessment areas and review working papers, evidence mapping, findings and scoring for consistency and quality.
Establish a consistent assessment and evidence-evaluation approach across the team.
Challenge unsupported conclusions and ensure professional judgements are evidence-based and clearly documented.
Coordinate with technical specialists so relevant IT/OT findings are appropriately incorporated into GRC and compliance assessments.
Escalate material evidence gaps, scope limitations, dependencies and risks through the agreed governance route.
Present findings, maturity positions, risks and recommendations to customer SMEs, management and executives.

Requirements

Current PriCSP (Audit) certification/accreditation is mandatory for this role.
Strong practical experience in cyber security governance, risk and compliance, assurance, audit or security maturity assessment.
Demonstrable experience delivering structured gap assessments against recognised cyber security frameworks, standards or regulatory requirements.
Experience with NCSC CAF/eCAF assessments or comparable control-based assurance frameworks.
Strong evidence-assessment capability, including determining relevance, sufficiency, reliability, currency, consistency and traceability of evidence.
Experience reviewing security policies, standards, procedures, risk registers, control evidence, architecture artefacts and operational records.
Experience assessing control design and, where appropriate, control implementation and operating effectiveness.
Strong stakeholder interviewing, workshop facilitation and challenge skills across technical, operational and senior-management audiences.
Ability to write clear, defensible findings and recommendations suitable for executive, audit and regulatory audiences.
Experience translating findings into prioritised remediation actions, control improvements and evidence requirements.
Experience operating in complex environments spanning business, IT and/or OT stakeholders.
Critical National Infrastructure, utilities, water, energy, transport, government or similarly regulated-sector experience.
Experience supporting NIS compliance, regulatory submissions, audit readiness or formal assurance programmes.
Experience conducting mock assessments, executive challenge sessions or independent quality reviews.

Skills

Cyber security governance
Risk management
Compliance
Assurance
Audit
Security maturity assessment
NCSC CAF/eCAF assessments
Control-based assurance frameworks
Evidence assessment
Policy review
Standards review
Procedure review
Risk register review
Control evidence review
Architecture artefact review
Operational record review
Stakeholder interviewing
Workshop facilitation
Remediation planning
NIS compliance
Regulatory submissions
Audit readiness
Quality reviews

Location

Remote

Work Type

Full-time

Experience Level

Lead
Senior

Education Level

PriCSP (Audit) certification/accreditation
CISSP
CISM
CRISC
GICSP
ISO 27001 Lead Auditor/Lead Implementer

About the Company

NTT DATA is a $30+ billion business and technology services leader, serving 75% of the Fortune Global 100.
We are committed to accelerating client success and positively impacting society through responsible innovation.
We are one of the world’s leading AI and digital infrastructure providers, with unmatched capabilities in enterprise-scale AI, cloud, security, connectivity, data centers and application services.
Our consulting and industry solutions help organizations and society move confidently and sustainably into the digital future.
As a Global Top Employer, we have experts in more than 70 countries.
We also offer clients access to a robust ecosystem of innovation centers as well as established and start-up partners.
NTT DATA is part of NTT Group, which invests over $3 billion each year in R&D.

Equal Opportunity

NTT DATA is proud to be an Equal Opportunity Employer with a global culture that embraces diversity.
We are committed to providing an environment free of unfair discrimination and harassment.
We do not discriminate based on age, race, colour, gender, sexual orientation, religion, nationality, disability, pregnancy, marital status, veteran status, or any other protected category.
Join our growing global team and accelerate your career with us. Apply today.