GRC Consultant

Seeking a German-speaking Principal Cloud Security and GRC Lead with 15+ years of experience in enterprise Governance, Risk and Compliance, Microsoft 365/Azure security, cloud solution architecture, audit and regulatory compliance. The role will lead customer-facing GRC and cloud-security services, establish and operate a resilient GRC framework, support M365 governance and compliance maturity assessment, and translate complex risk and compliance topics into clear business outcomes

Key Responsibilities

• Lead the customer-facing Cloud Security and GRC service, coordinate a global delivery team, and act as a trusted advisor to stakeholders.
• Establish, maintain and continuously improve the enterprise GRC operating model across policy and compliance management, risk management, audit management, control assurance, evidence management and regulatory reporting.
• Lead implementation and operation of Microsoft Compliance Manager (MCM), Alyne GRC and/or comparable integrated risk management platforms, including configuration, upgrades, migration, workflow design and reporting.
• Drive the M365 Governance, Risk and Compliance maturity assessment: establish the current-state baseline, assess maturity, identify gaps, define the target state and produce prioritized recommendations and a remediation roadmap.
• Use Microsoft Purview, Microsoft Defender for Cloud and relevant Microsoft security/compliance capabilities to support security posture reviews, benchmarking, control validation and actionable recommendations, subject to available licensing and access.
• Architect and govern secure Microsoft Azure and M365 solutions using native security controls, Microsoft Defender capabilities, identity governance and cloud security best practices.
• Perform and coordinate security and compliance risk assessments, control reviews and audit support across cloud and M365 environments; maintain risk, issue, action and evidence registers.
• Support internal and external audits, ensure timely closure of findings and compliance gaps, and provide clear management reporting on risks, exceptions, actions and control effectiveness.
• Align controls with applicable frameworks and regulations, including ISO 27001, NIST CSF, CSA Cloud Controls Matrix, COBIT 2019, GDPR, DORA, SOX ITGC and relevant organizational policies.
• Facilitate solution and control workshops, document high-level and detailed designs, define governance processes and RACI, and maintain current policies, procedures, control narratives and operating documentation.
• Provide strategic guidance for cloud security incidents, risk treatment and exception management, and coordinate with technical, business, legal, privacy, audit and service-management stakeholders.
• Drive project milestones, SLA adherence, governance cadence, escalation management and continuous service improvement; mentor delivery teams and build customer awareness of cloud security and GRC practices.