Senior Compliance Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee the full implementation and certification of Accela's ISO/IEC 27001:2022 program.

• Create and manage implementation plans, including milestones, deliverables, and stakeholder responsibilities.

• Perform gap assessments, pinpoint compliance requirements, and orchestrate remediation efforts.

• Define and uphold the ISMS scope, objectives, and Statement of Applicability.

• Manage external certification, surveillance, and recertification audits, which includes preparation, evidence collection, stakeholder interviews, and addressing findings.

• Track progress, risks, and dependencies while providing regular updates to the GRC Manager.

• Conduct and maintain information security risk assessments, risk registers, and risk treatment plans.

• Collaborate with control owners to implement, evaluate, document, and monitor ISO 27001 controls.

• Assess control effectiveness, identify deficiencies, and ensure remediation is completed.

• Organize internal audits, management reviews, corrective actions, and continual improvement initiatives.

• Keep abreast of organizational and regulatory changes that impact ISMS requirements and compliance obligations.

• Develop and sustain information security policies, procedures, standards, and relevant ISMS documentation.

• Establish processes for documentation management, control assessments, evidence collection, and compliance monitoring.

• Ensure documentation and records are accurate, current, approved, and ready for audit.

• Integrate ISO 27001 requirements into existing business operations.

• Maintain ISO 27001 requirements, controls, risks, evidence, and remediation activities within Accela's GRC platform, including Drata.

• Map controls and evidence to ISO 27001 requirements while utilizing automation for evidence collection, reporting, and audit preparedness.

• Define control ownership, evidence requirements, and continuous monitoring processes.

• Collaborate with Information Security, IT, Engineering, HR, Legal, Finance, and other stakeholders to operationalize ISO 27001 requirements.

• Communicate compliance expectations, priorities, and timelines while fostering cross-functional accountability.

• Align ISO 27001 efforts with broader GRC initiatives in conjunction with the GRC Manager.

• Utilize SOC 2 controls and evidence, supporting alignment with GovRAMP, NIST SP 800-53, and PCI DSS.

• Provide updates on certification readiness, program milestones, compliance gaps, and remediation progress.

⛳️ Requirements

• A minimum of 5 years of experience in governance, risk, and compliance (GRC), information security compliance, security assurance, or a related area.

• Proven experience leading or significantly owning an ISO/IEC 27001 implementation and certification initiative.

• In-depth knowledge of ISO/IEC 27001:2022 requirements, ISMS operations, risk assessment, risk treatment, control implementation, and audit procedures.

• Experience in preparing for and coordinating external certification audits, including evidence management and addressing findings.

• Experience in creating and maintaining compliance policies, procedures, risk assessments, and control documentation.

• Practical experience with a GRC or compliance automation platform, such as Drata or a similar solution.

• Strong project management, analytical, and organizational abilities.

• Exceptional communication and stakeholder management skills, including the ability to translate technical requirements into actionable business processes.

• Ability to influence and promote accountability across cross-functional teams without direct reporting authority.

• ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CGRC, or a comparable professional certification.

• Familiarity with SOC 2 Type II, GovRAMP, NIST SP 800-53, CIS Controls, or PCI DSS.

• A bachelor's degree in Information Security, Cybersecurity, Information Technology, Risk Management, or a related field, or equivalent practical experience (preferred).

• Experience supporting GRC programs within a SaaS, cloud technology, or enterprise software environment (preferred).

• Knowledge of AWS or similar cloud environments and related security controls (preferred).

• Experience in leveraging compliance automation platforms and integrating requirements across multiple compliance frameworks (preferred).

🏝️ Benefits

• Annual bonus target; discretionary bonus based on achievement of company and individual goals.

• Flexible time off policy.

• Comprehensive medical, dental, and vision insurance plans.

• Family planning assistance.

• 401(k) retirement savings plan with company matching.

• Health savings account with company contributions.

• Flexible spending account.

• Life, accident, and disability insurance coverage.

• Business travel insurance.

• Employee assistance programs.

• Additional well-being benefits.

• Job accommodations available upon request.