Want to know if this job is worth applying to?
United States
Remote only
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Sr. Compliance Analyst based in the United States.
The Senior Compliance Analyst will lead the implementation, certification, and ongoing management of an ISO/IEC 27001:2022 Information Security Management System (ISMS). In this remote role, you will drive security compliance initiatives, coordinate certification audits, and strengthen risk management practices across a cloud-based software environment. You will collaborate with teams across information security, engineering, IT, legal, HR, and finance to embed effective controls and maintain continuous audit readiness. Combining hands-on compliance expertise with strong project management skills, you will oversee remediation plans, streamline evidence collection, and improve governance processes. You will also help align ISO 27001 requirements with existing SOC 2 controls and other relevant security frameworks. This is an opportunity to take ownership of a critical security program while contributing to the reliability, transparency, and trustworthiness of technology solutions serving public-sector organizations.
You will own key compliance initiatives from implementation through certification and ongoing monitoring, ensuring that security controls, documentation, and risk management practices remain effective and audit-ready. Your responsibilities will include:
ISO 27001 Implementation and Certification: Lead the end-to-end implementation and certification of the ISO/IEC 27001:2022 program, establishing implementation plans, milestones, deliverables, and stakeholder responsibilities.
Gap Assessments and Remediation: Assess existing practices against ISO 27001 requirements, identify compliance gaps, coordinate remediation activities, and track progress against established timelines.
ISMS Management: Define and maintain the ISMS scope, objectives, and Statement of Applicability (SoA), ensuring that the management system remains aligned with organizational and certification requirements.
Audit Coordination: Coordinate external certification, surveillance, and recertification audits, including preparation, evidence collection, stakeholder interviews, and resolution of audit findings.
Risk Management and Controls: Conduct and maintain information security risk assessments, risk registers, and risk treatment plans. Work with control owners to implement, document, assess, and monitor applicable controls.
Internal Audits and Continuous Improvement: Coordinate internal audits, management reviews, corrective actions, and ongoing improvement activities. Evaluate control effectiveness and ensure identified weaknesses are addressed.
Policies and Documentation: Develop and maintain information security policies, procedures, standards, and supporting ISMS documentation. Ensure records are accurate, current, appropriately approved, and readily available for audits.
GRC Platform Administration: Maintain requirements, risks, controls, evidence, and remediation activities within the governance, risk, and compliance (GRC) platform, including Drata or comparable tools.
Evidence Management and Automation: Map existing controls and evidence to ISO 27001 requirements, establish clear ownership and monitoring processes, and leverage automation to streamline evidence collection and compliance reporting.
Cross-Functional Collaboration: Partner with Information Security, IT, Engineering, HR, Legal, Finance, and other stakeholders to integrate compliance requirements into business processes and drive accountability across teams.
Framework Alignment: Reuse existing SOC 2 controls and evidence where appropriate and support alignment with other frameworks, including GovRAMP, NIST SP 800-53, and PCI DSS.
Program Reporting: Provide regular updates to the GRC Manager on certification readiness, milestones, risks, dependencies, compliance gaps, and remediation progress.
Requirements:
The ideal candidate brings substantial hands-on experience in information security compliance, a strong understanding of ISO 27001, and the ability to lead complex cross-functional initiatives independently. Key qualifications include:
Professional Experience: At least 5 years of experience in governance, risk and compliance (GRC), information security compliance, security assurance, or a related field.
ISO 27001 Implementation: Demonstrated experience leading or substantially owning an ISO/IEC 27001 implementation and certification initiative.
Standards and ISMS Expertise: Strong knowledge of ISO/IEC 27001:2022 requirements, ISMS operations, risk assessment and treatment, control implementation, and audit processes.
Audit Readiness: Experience preparing for and coordinating external certification audits, including evidence management, stakeholder coordination, and remediation of audit findings.
Policies and Control Documentation: Proven ability to develop and maintain compliance policies, procedures, risk assessments, control documentation, and supporting records.
GRC and Automation Tools: Hands-on experience with a GRC or compliance automation platform, such as Drata or an equivalent solution.
Project Management: Strong organizational, analytical, and project management skills, with the ability to independently manage complex initiatives, competing priorities, milestones, and deadlines.
Communication and Stakeholder Management: Excellent communication skills, including the ability to translate technical security requirements into practical business processes and communicate expectations clearly to diverse stakeholders.
Cross-Functional Influence: Ability to build relationships, influence stakeholders, and drive accountability across teams without direct reporting authority.
Professional Certifications: ISO/IEC 27001 Lead Implementer, ISO/IEC 27001 Lead Auditor, CISA, CGRC, or a comparable professional certification.
Additional Security Frameworks: Working knowledge of SOC 2 Type II, GovRAMP, NIST SP 800-53, CIS Controls, or PCI DSS.
Preferred qualifications include:
A bachelor's degree in Information Security, Cybersecurity, Information Technology, Risk Management, or a related field, or equivalent practical experience.
Experience supporting GRC programs in a SaaS, cloud technology, or enterprise software environment.
Familiarity with AWS or comparable cloud environments and their associated security controls.
Experience using compliance automation platforms and integrating requirements across multiple security and compliance frameworks.
Benefits:
The compensation and benefits package is designed to support financial well-being, flexibility, and comprehensive health coverage. Benefits include:
Base Salary: $120,000–$140,000 annually, before applicable taxes. The final offer may vary based on location, education, skills, training, and experience.
Annual Bonus: Eligibility for a discretionary annual bonus, with a target based on company and individual goal achievement.
Medical, Dental, and Vision Insurance: Comprehensive healthcare plan options.
Flexible Time Off: Flexible paid time off to support work-life balance.
Retirement Savings: 401(k) retirement plan with a company match.
Health Savings Account: HSA with company contributions.
Flexible Spending Account: Access to an FSA for eligible expenses.
Family Planning Benefits: Benefits designed to support family planning needs.
Insurance Coverage: Life, accident, disability, and business travel insurance.
Employee Assistance Program: Access to resources supporting personal well-being.
Additional Well-Being Benefits: Other programs and resources designed to support employees' overall health and well-being.
Remote Work: Remote-based position within the United States.
Inclusive Workplace: Commitment to equal employment opportunities and consideration of reasonable accommodations for qualified candidates.