Back to jobs
New

Cybersecurity GRC (Governance, Risk & Compliance) Specialist

Boston, Massachusetts, United States

The Brattle Group, a privately held, global economics consulting firm, is looking for a Cybersecurity GRC (Governance, Risk & Compliance) Specialist to join our Boston, MA office. The Cybersecurity GRC Specialist is responsible for working with the Manager of Cybersecurity to implement and manage the firm’s Governance, Risk, and Compliance framework. The role focuses on aligning policies and controls with industry regulations, performing risk assessments, supporting compliance audits, and promoting a culture of accountability and ethical conduct.

Some of the day-to-day responsibilities of this role include:

  • Develop and maintain internal policies and procedures that support compliance with industry regulations (e.g., ISO 27001, NIST, SOC 2, GDPR), including maintaining POA&Ms and ATU artifacts
  • Perform regular risk assessments and update the firm’s risk register.
  • Collaborate with IT and Legal teams to address risks and control deficiencies.
  • Monitor regulatory changes and evaluate their impact on firm operations.
  • Provide support during internal and external audits, including evidence gathering.
  • Lead or support compliance training sessions and awareness campaigns for staff.
  • Lead initiatives for compliance automation, continuous control monitoring, and process optimization.
  • Maintain third-party risk management documentation and review vendor contracts for compliance implications.
  • Lead external annual external penetration and vulnerability testing and analysis.
  • Update and manage governance documents, risk management policies, and compliance tracking logs.
  • Maintain audit trail documentation for regulatory and internal control requirements.
  • Contribute to annual compliance reports and board-level risk summaries.

THE CANDIDATE

  • Bachelor’s degree in Business, Law, Information Systems, or a related field
  • 3–5 years of experience in GRC, internal audit, compliance, or risk management
  • Familiarity with GRC platforms (e.g., ServiceNow GRC, Archer, LogicGate)
  • Working knowledge of risk assessment methodologies and control frameworks
  • Understanding of privacy laws and data protection requirements
  • One or more certifications such as CRISC, CISA, CIPP, CISSP, or CISM
  • Experience conducting control testing and compliance audits
  • Ability to interpret legal and regulatory texts into business requirements

 

Brattle offers a competitive benefits package, base salary, and bonus program for eligible roles based on individual and firm performance. The anticipated base gross salary range for this position in Boston, MA is $105,000–$115,000 annually.  Actual salary will depend on a variety of factors, including experience and training.

 

This position is not eligible for immigration sponsorship.

 

THE EMPLOYER

The Brattle Group answers complex economic, finance, and regulatory questions for corporations, law firms, and governments around the world. We are distinguished by the clarity of our insights and the credibility of our experts, which include leading international academics and industry specialists. Brattle has 500 talented professionals across North America, Europe, and Asia-Pacific. For more information, please visit brattle.com​.​​​​​

 

EQUAL OPPORTUNITY

The Brattle Group is an Equal Opportunity Employer.  All qualified applicants will receive consideration for employment without regard to race, color, creed, religion, citizenship status, national origin, ancestry, sex, gender identity and expression, age, height, weight, domestic partner status, Acquired Immune Deficiency Syndrome or HIV status (AIDS/HIV status), genetic information, sexual orientation, disability (where the applicant or employee is qualified to perform the essential functions of the job with or without reasonable accommodation), marital status, veteran status, political affiliation, drug or alcohol abuse or alcoholism, or any other characteristic protected under applicable law.

 

We encourage all applicants to click here to review our full Equal Employer Opportunity Statement.  

 

Create a Job Alert

Interested in building your career at The Brattle Group? Get future opportunities sent straight to your email.

Apply for this job

*

indicates a required field

Resume/CV*

Accepted file types: pdf, doc, docx, txt, rtf

Cover Letter

Accepted file types: pdf, doc, docx, txt, rtf

Select...
Select...
Select...

We ask this question to ensure we stay compliant with local data privacy laws.

Select...
Any personal data collected by Brattle when using Brattle's Careers Page will be processed in accordance with Brattle's Recruitment Privacy Notice linked below. By checking “I agree”, you acknowledge and agree you have read and agree to the terms of Brattle’s Recruitment Privacy Notice. If you do not agree to Brattle's Recruitment Privacy Notice, please do not use Brattle's Careers Page. *

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in The Brattle Group’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

Select...
Select...
Race & Ethnicity Definitions

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Select...

Voluntary Self-Identification of Disability

Form CC-305
Page 1 of 1
OMB Control Number 1250-0005
Expires 04/30/2026

Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at www.dol.gov/ofccp.

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

  • Alcohol or other substance use disorder (not currently using drugs illegally)
  • Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
  • Blind or low vision
  • Cancer (past or present)
  • Cardiovascular or heart disease
  • Celiac disease
  • Cerebral palsy
  • Deaf or serious difficulty hearing
  • Diabetes
  • Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
  • Epilepsy or other seizure disorder
  • Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
  • Intellectual or developmental disability
  • Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
  • Missing limbs or partially missing limbs
  • Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
  • Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
  • Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
  • Partial or complete paralysis (any cause)
  • Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
  • Short stature (dwarfism)
  • Traumatic brain injury
Select...

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.