Sr. Compliance Analyst

Job description

**This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Sr. Compliance Analyst based in the United States.** The Senior Compliance Analyst will lead the implementation, certification, and ongoing management of an ISO/IEC 27001:2022 Information Security Management System (ISMS). In this remote role, you will drive security compliance initiatives, coordinate certification audits, and strengthen risk management practices across a cloud-based software environment. You will collaborate with teams across information security, engineering, IT, legal, HR, and finance to embed effective controls and maintain continuous audit readiness. Combining hands-on compliance expertise with strong project management skills, you will oversee remediation plans, streamline evidence collection, and improve governance processes. You will also help align ISO 27001 requirements with existing SOC 2 controls and other relevant security frameworks. This is an opportunity to take ownership of a critical security program while contributing to the reliability, transparency, and trustworthiness of technology solutions serving public-sector organizations. ### Accountabilities: You will own key compliance initiatives from implementation through certification and ongoing monitoring, ensuring that security controls, documentation, and risk management practices remain effective and audit-ready. Your responsibilities will include: - **ISO 27001 Implementation and Certification:** Lead the end-to-end implementation and certification of the ISO/IEC 27001:2022 program, establishing implementation plans, milestones, deliverables, and stakeholder responsibilities. - **Gap Assessments and Remediation:** Assess existing practices against ISO 27001 requirements, identify compliance gaps, coordinate remediation activities, and track progress against established timelines. - **ISMS Management:** Define and maintain the ISMS scope, objectives, and Statement of Applicability (SoA), ensuring that the management system remains aligned with organizational and certification requirements. - **Audit Coordination:** Coordinate external certification, surveillance, and recertification audits, including preparation, evidence collection, stakeholder interviews, and resolution of audit findings. - **Risk Management and Controls:** Conduct and maintain information security risk assessments, risk registers, and risk treatment plans. Work with control owners to implement, document, assess, and monitor applicable controls. - **Internal Audits and Continuous Improvement:** Coordinate internal audits, management reviews, corrective actions, and ongoing improvement activities. Evaluate control effectiveness and ensure identified weaknesses are addressed. - **Policies and Documentation:** Develop and maintain information security policies, procedures, standards, and supporting ISMS documentation. Ensure records are accurate, current, appropriately approved, and readily available for audits. - **GRC Platform Administration:** Maintain requirements, risks, controls, evidence, and remediation activities within the governance, risk, and compliance (GRC) platform, including Drata or comparable tools. - **Evidence Management and Automation:** Map existing controls and evidence to ISO 27001 requirements, establish clear ownership and monitoring processes, and leverage automation to streamline evidence collection and compliance reporting. - **Cross-Functional Collaboration:** Partner with Information Security, IT, Engineering, HR, Legal, Finance, and other stakeholders to integrate compliance requirements into business processes and drive accountability across teams. - **Framework Alignment:** Reuse existing SOC 2 controls and evidence where appropriate and support alignment with other frameworks, including GovRAMP, NIST SP 800-53, and PCI DSS. - **Program Reporting:** Provide regular updates to the GRC Manager on certification readiness, milestones, risks, dependencies, compliance gaps, and remediation progress. **Requirements:** The ideal candidate brings substantial hands-on experience in information security compliance, a strong understanding of ISO 27001, and the ability to lead complex cross-functional initiatives independently. Key qualifications include: - **Professional Experience:** At least 5 years of experience in governance, risk and compliance (GRC), information security compliance, security assurance, or a related field. - **ISO 27001 Implementation:** Demonstrated experience leading or substantially owning an ISO/IEC 27001 implementation and certification initiative. - **Standards and ISMS Expertise:** Strong knowledge of ISO/IEC 27001:2022 requirements, ISMS operations, risk assessment and treatment, control implementation, and audit processes. - **Audit Readiness:** Experience preparing for and coordinating external certification audits, including evidence management, stakeholder coordination, and remediation of audit findings. - **Policies and Control Documentation:** Proven ability to develop and maintain compliance policies, procedures, risk assessments, control documentation, and supporting records. - **GRC and Automation Tools:** Hands-on experience with a GRC or compliance automation platform, such as Drata or an equivalent solution. - **Project Management:** Strong organizational, analytical, and project management skills, with the ability to independently manage complex initiatives, competing priorities, milestones, and deadlines. - **Communication and Stakeholder Management:** Excellent communication skills, including the ability to translate technical security requirements into practical business processes and communicate expectations clearly to diverse stakeholders. - **Cross-Functional Influence:** Ability to build relationships, influence stakeholders, and drive accountability across teams without direct reporting authority. - **Professional Certifications:** ISO/IEC 27001 Lead Implementer, ISO/IEC 27001 Lead Auditor, CISA, CGRC, or a comparable professional certification. - **Additional Security Frameworks:** Working knowledge of SOC 2 Type II, GovRAMP, NIST SP 800-53, CIS Controls, or PCI DSS. Preferred qualifications include: - A bachelor's degree in Information Security, Cybersecurity, Information Technology, Risk Management, or a related field, or equivalent practical experience. - Experience supporting GRC programs in a SaaS, cloud technology, or enterprise software environment. - Familiarity with AWS or comparable cloud environments and their associated security controls. - Experience using compliance automation platforms and integrating requirements across multiple security and compliance frameworks. **Benefits:** The compensation and benefits package is designed to support financial well-being, flexibility, and comprehensive health coverage. Benefits include: - **Base Salary:** $120,000–$140,000 annually, before applicable taxes. The final offer may vary based on location, education, skills, training, and experience. - **Annual Bonus:** Eligibility for a discretionary annual bonus, with a target based on company and individual goal achievement. - **Medical, Dental, and Vision Insurance:** Comprehensive healthcare plan options. - **Flexible Time Off:** Flexible paid time off to support work-life balance. - **Retirement Savings:** 401(k) retirement plan with a company match. - **Health Savings Account:** HSA with company contributions. - **Flexible Spending Account:** Access to an FSA for eligible expenses. - **Family Planning Benefits:** Benefits designed to support family planning needs. - **Insurance Coverage:** Life, accident, disability, and business travel insurance. - **Employee Assistance Program:** Access to resources supporting personal well-being. - **Additional Well-Being Benefits:** Other programs and resources designed to support employees' overall health and well-being. - **Remote Work:** Remote-based position within the United States. - **Inclusive Workplace:** Commitment to equal employment opportunities and consideration of reasonable accommodations for qualified candidates.