Senior Associate, RAS

Remote: yes Posted: 2026-08-20

In today's dynamic environment, business leaders face constantly shifting risks. Riveron helps organizations implement leading governance, risk and compliance practices by combining deep expertise with pragmatic partnership, using a hands-on approach to understand the specific needs of the organization and create tailored solutions to address key compliance risks.

Our Cyber Security Advisory (CSA) services include building GRC/Cybersecurity programs from the ground up, framework readiness, design and maintenance of critical security domains, managed internal controls testing and monitoring, co-sourced/outsourced internal audit, segregation of duties and access risk review, policy and procedure development, enterprise risk management, and IT and cybersecurity risk assessment.

The Sr Associate level position for Riveron's CSA group will work collaboratively with delivery team members who provide guidance, coaching, and direction. The role includes supporting the implementation of GRC/Cybersecurity programs, assessing the design and operating effectiveness of IT General Controls (ITGC), developing and executing remediation roadmaps, incident response, completing vendor reviews, and performing IT risk assessments.

WHAT YOU HAVE

● Bachelor's and/or Master's degree in Information Technology (IT), Computer Information Systems (CIS), Management Information Systems (MIS), or a related field

● Relevant certification preferred: CompTIA Security+, CISA, CISM, CISSP, or AWS Cloud Practitioner

● 3+ years of experience in an IT Audit, Cybersecurity, or IT Risk Advisory role (candidates with 5+ years and prior management experience are encouraged to apply)

● Demonstrated knowledge regarding implementation of compliance frameworks such as SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST, FedRAMP, and CMMC

● Familiarity with GRC solutions, tools, and technologies

● Support delivery team in implementing cybersecurity programs aligned with SOC 2, ISO 27001, and other security and privacy frameworks

● Own day-to-day GRC platform operations, including monitoring automated testing results, tracking controls, managing evidence uploads, inputting vendor and risk records, and maintaining policy assignments