Sr. Compliance Analyst

Role overview

Own the implementation, certification, and ongoing operation of an ISO/IEC 27001:2022 information security management system. Working with a GRC manager and teams across security, IT, engineering, legal, HR, and finance, you will coordinate controls, audits, risk treatment, and continual improvement while keeping the program ready for external review.

Responsibilities

- Plan the certification effort, set milestones and ownership, assess gaps, define the ISMS scope and objectives, and maintain the Statement of Applicability. - Coordinate certification, surveillance, and recertification audits, including evidence gathering, interviews, readiness activities, and responses to findings. - Maintain security risk assessments, risk registers, treatment plans, and records of control implementation and effectiveness. - Organize internal audits, management reviews, corrective actions, and remediation tracking; monitor changes that affect compliance obligations. - Keep policies, procedures, standards, and ISMS documentation accurate, approved, and audit-ready, integrating requirements into existing processes. - Maintain controls, risks, evidence, and remediation in a GRC platform; report milestones, gaps, dependencies, and readiness to stakeholders.

Requirements

- 5+ years in GRC, information security compliance, security assurance, or a related area. - Demonstrated ownership of an ISO/IEC 27001 implementation and certification, with strong knowledge of the 2022 standard, ISMS operations, risk treatment, controls, and audits. - Experience preparing for external audits, managing evidence, and coordinating remediation of findings. - Ability to develop compliance policies and control documentation and use a GRC or compliance automation platform. - Strong project management, analytical, communication, and organizational skills; able to manage competing priorities and drive accountability across teams. - ISO 27001 Lead Implementer or Lead Auditor, CISA, CGRC, or comparable certification; familiarity with SOC 2, GovRAMP, NIST SP 800-53, or PCI DSS is also relevant.

Benefits and work setup

The position is listed as remote. U.S. benefits include flexible time off, medical, dental, and vision coverage, family planning support, retirement matching, health savings and flexible spending accounts, insurance coverage, travel insurance, and employee assistance programs.