Sr. Compliance Analyst

Sr. Compliance Analyst

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Sr. Compliance Analyst based in the United States.

The Senior Compliance Analyst will lead the implementation, certification, and ongoing management of an ISO/IEC 27001:2022 Information Security Management System (ISMS). In this remote role, you will drive security compliance initiatives, coordinate certification audits, and strengthen risk management practices across a cloud-based software environment. You will collaborate with teams across information security, engineering, IT, legal, HR, and finance to embed effective controls and maintain continuous audit readiness.

Combining hands-on compliance expertise with strong project management skills, you will oversee remediation plans, streamline evidence collection, and improve governance processes. You will also help align ISO 27001 requirements with existing SOC 2 controls and other relevant security frameworks. This is an opportunity to take ownership of a critical security program while contributing to the reliability, transparency, and trustworthiness of technology solutions serving public-sector organizations.

Accountabilities:

You will own key compliance initiatives from implementation through certification and ongoing monitoring, ensuring that security controls, documentation, and risk management practices remain effective and audit-ready. Your responsibilities will include:

• ISO 27001 Implementation and Certification:
  Lead the end-to-end implementation and certification of the ISO/IEC 27001:2022 program, establishing implementation plans, milestones, deliverables, and stakeholder responsibilities.
• Gap Assessments and Remediation:
  Assess existing practices against ISO 27001 requirements, identify compliance gaps, coordinate remediation activities, and track progress against established timelines.
• ISMS Management:
  Define and maintain the ISMS scope, objectives, and Statement of Applicability (SoA), ensuring that the management system remains aligned with organizational and certification requirements.
• Audit Coordination:
  Coordinate external certification, surveillance, and recertification audits, including preparation, evidence collection, stakeholder interviews, and resolution of audit findings.
• Risk Management and Controls:
  Conduct and maintain information security risk assessments, risk registers, and risk treatment plans. Work with control owners to implement, document, assess, and monitor applicable controls.
• Internal Audits and Continuous Improvement:
  Coordinate internal audits, management reviews, corrective actions, and ongoing improvement activities. Evaluate control effectiveness and ensure identified weaknesses are addressed.
• Policies and Documentation:
  Develop and maintain information security policies, procedures, standards, and supporting ISMS documentation. Ensure records are accurate, current, appropriately approved, and readily available for audits.
• GRC Platform Administration:
  Maintain requirements, risks, controls, evidence, and remediation activities within the governance, risk, and compliance (GRC) platform, including Drata or comparable tools.
• Evidence Management and Automation:
  Map existing controls and evidence to ISO 27001 requirements, establish clear ownership and monitoring processes, and leverage automation to streamline evidence collection and compliance reporting.
• Cross-Functional Collaboration:
  
  Partner with Information Security, IT, Engineering, HR, Legal, Finance, and other stakeholders to integrate compliance requirements into business processes and drive accountability across teams.
• Framework Alignment:
  Reuse existing SOC 2 controls and evidence where appropriate and support alignment with other frameworks, including GovRAMP, NIST SP 800-53, and PCI DSS.
• Program Reporting:
  Provide regular updates to the GRC Manager on certification readiness, milestones, risks, dependencies, compliance gaps, and remediation progress.

Requirements:

The ideal candidate brings substantial hands-on experience in information security compliance, a strong understanding of ISO 27001, and the ability to lead complex cross-functional initiatives independently. Key qualifications include:

• Professional
  
  Experience:
  
  At least 5 years of experience in governance, risk and compliance (GRC), information security compliance, security assurance, or a related field.
• ISO 27001 Implementation:
  Demonstrated experience leading or…