Governance, Risk & Compliance Consultant

Company: Ravnok

Location: Nairobi, Kenya — remote work within Kenya, with agreed client visits

Engagement: Independent contractor, project-based

Compensation: Agreed project fees, paid against defined milestones and accepted deliverables

About Ravnok

Compliance should be operational—not a folder nobody opens.

Ravnok helps Kenyan businesses become secure, compliant, and AI-ready—without needing a large in-house security team.

Through Assess → Build → Manage, we help clients understand their gaps, establish practical controls, and maintain evidence and accountability.

We are looking for a GRC Consultant who can turn requirements, risks, and technical findings into a programme that a growing business can actually run.

Your mission

Make requirements clear. Build practical processes. Keep evidence defensible.

You will work alongside Ravnok’s founder and a Security Engineer. You will lead governance, risk, compliance-readiness, and documentation activities within your expertise—not simply produce generic policy templates.

What you will doAssess

• Help scope compliance-readiness and governance reviews.
• Identify the client’s relevant obligations, customer requirements, and agreed framework coverage.
• Review existing policies, procedures, risk registers, and evidence.
• Support Kenya data-protection readiness reviews within your demonstrated expertise.
• Conduct stakeholder interviews and document how processes actually operate.
• Work with the Security Engineer to connect technical findings to business risks and control gaps.
• Produce prioritised recommendations with clear limitations.

Build

• Develop client-specific policies and procedures.
• Create or improve risk registers, asset registers, processing records, and control ownership records.
• Support data mapping, retention processes, vendor reviews, and incident-response procedures.
• Organise compliance evidence and define evidence owners.
• Support ISO 27001 or SOC 2 readiness work where your experience matches the engagement.
• Develop practical staff-awareness materials.
• Document outstanding actions, dependencies, and handover requirements.

Manage

• Maintain agreed policies, registers, and evidence records.
• Track control-review schedules and open remediation actions.
• Support vendor-risk reviews and customer security questionnaires.
• Prepare periodic compliance-status reports.
• Facilitate client review meetings and document decisions.
• Support audit preparation and external-assessor coordination where contracted.

What you should bring

• Demonstrable experience in information-security GRC, risk management, compliance consulting, or related assurance work.
• Working knowledge of Kenya’s data-protection requirements.
• Practical experience with at least one relevant framework or assurance programme, such as ISO 27001 or SOC 2 readiness.
• Ability to distinguish written policies from controls that are actually operating.
• Strong report writing, stakeholder interviewing, and workshop skills.
• Ability to explain requirements clearly to non-technical business owners.
• Sound judgment about when legal advice, specialist privacy expertise, or independent assurance is required.
• Reliable organisation, version control, and deadline management.

Relevant certifications are welcome, including ISO 27001 qualifications, CISA, CRISC, or comparable credentials. Evidence of practical delivery is essential.

Useful additional experience

• SaaS, digital agencies, professional-services firms, or other growing Kenyan businesses.
• Privacy operations and data-subject request processes.
• Business continuity and incident-readiness exercises.
• Third-party risk management.
• Responsible AI-use policies and AI vendor-risk reviews.
• Compliance evidence-management tools.

How we work

• Requirements must be tied to the agreed engagement.
• Policies must reflect the client’s actual operations.
• Evidence must support reported conclusions.
• Missing evidence and assessment limitations must remain visible.
• No guarantees of legal compliance or certification.
• No client data in unapproved AI services.
• Technical findings must be validated by the responsible technical specialist.

You are not expected to act as legal counsel, an independent certification body, or a client’s appointed Data Protection Officer unless separately qualified and expressly engaged for that role.

Engagement and payment

This is a paid contractor opportunity, not a guaranteed monthly salary.

For each engagement, we agree:

• Scope and deliverables.
• Availability and deadlines.
• Project fee.
• Payment milestones.
• Acceptance criteria and correction process.
• Any separately approved expenses.

Recurring managed-service work may use an agreed monthly work package. Work is assigned according to client demand, expertise, and availability. No minimum project volume is guaranteed.

How to apply

Send the following to ravnokcompany@gmail.com:

1. Your CV or LinkedIn profile.
2. Two relevant engagement examples explaining your personal contribution.
3. A redacted or fictional sample, such as a gap assessment, risk register, policy, or executive report.
4. Frameworks and sectors in which you have delivered work.
5. Your availability and indicative project or day rates.

Do not submit confidential client information.

Subject: Ravnok — GRC Consultant