Information Security & Compliance Senior Analyst

Description

Who We Are

Our purpose at CloudHQ is to provide flexible, efficient, and resilient data center solutions to businesses of all sizes. Our growing organization was founded by the pioneer of data center REITs. CloudHQ has state-of-the-art data center sites located on two Northern Virginia campuses, as well as London, Frankfurt, Paris, Milan, and São Paulo, and we anticipate exponential growth over the next several years both in the US and abroad.

Our company’s reach is expanded through our affiliate companies – Cloud Capital, Dalian Development, and WindHQ.

What

The Role Entails

The Senior Information Security & Compliance Analyst is a senior individual contributor supporting CloudHQ’s Governance, Risk, and Compliance (GRC), information security, audit, and compliance programs.

This role independently performs complex GRC activities, including risk and control assessments, internal audits, compliance assessments, evidence management, remediation tracking, and maintenance of compliance documentation.

The position works closely with the Information Security & Compliance Manager, Director of Audit & Compliance, and business and technical process owners to support compliance with ISO 27001:2022, SOC 1, SOC 2, ISO 14001, ISO 50001, and other applicable frameworks and requirements.

What You Will Get To Do

• Independently perform GRC, audit, risk, control, and compliance activities
• Support the maintenance and continual improvement of CloudHQ’s Information Security Management System (ISMS)
• Perform activities supporting ISO 27001:2022, SOC 1, SOC 2, and other applicable security and compliance frameworks
• Support ISO 14001 and ISO 50001 management system activities, as applicable
• Conduct internal audits, risk assessments, control assessments, gap assessments, and compliance reviews
• Support internal and external audits, certifications, and attestations, including evidence collection, documentation review, auditor requests, findings, and remediation
• Work directly with business and technical process owners to evaluate controls, identify gaps, and develop remediation actions
• Track audit findings, non-conformities, risks, corrective actions, and remediation activities through closure
• Maintain GRC platforms, including risk registers, control libraries, assessments, evidence, findings, remediation activities, and compliance reporting
• Develop, review, and maintain policies, standards, procedures, controls, and supporting compliance documentation
• Review evidence and documentation for completeness, accuracy, traceability, and audit readiness
• Provide GRC and compliance guidance to business and technical teams
• Monitor applicable compliance requirements and support updates to controls and documentation
• Prepare compliance, audit, risk, and remediation status information for management reporting
• Support security and compliance awareness and training initiatives
• Identify opportunities to improve and standardize GRC processes, documentation, workflows, and reporting
• Provide guidance and subject‑matter support to other analysts as needed

Requirements What You Will Bring to

The Role

• Minimum 5 years of professional experience demonstrated in Governance, Risk, and Compliance (GRC), cybersecurity compliance, IT audit, risk management, or closely related functions
• Minimum 5 years of demonstrated hands‑on experience with ISO 27001, SOC 1, SOC 2, and/or other recognized security, risk, or compliance frameworks
• Minimum 5 years of demonstrated hands‑on experience using GRC platforms such as One Trust, Hyperproof, RSA Archer, Service Now GRC, Audit Board, Logic Gate, or comparable GRC solutions
• Demonstrated experience conducting internal audits, control assessments, risk assessments, gap assessments, and compliance reviews
• Experience…