Senior Compliance Specialist

This is a fully remote position, open to applicants in United States.

📋 Description

• Take charge of the daily operations and ongoing enhancement of ISO 27001, SOC 2, and GDPR compliance initiatives.

• Manage the program scope, monitor compliance obligations, schedule reviews, maintain documentation, and ensure readiness for audits.

• Examine systems and workflows, evaluate the effectiveness of controls, and gather and verify evidence from Cloud Service Providers (CSPs) and internal systems.

• Direct the internal audit program, which includes planning and executing audits, documenting findings, and confirming corrective actions.

• Lead the effort to obtain CMMC certification, agency-specific Authorizations to Operate (ATOs), NIST SP 800-171 compliance, and other federal and defense requirements.

• Establish scope, evaluate controls, identify gaps, drive remediation efforts, identify relevant Security Technical Implementation Guides (STIGs), and maintain System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), and authorization documentation.

• Oversee enterprise risk management, chair risk committee meetings, maintain the risk register, and facilitate risk assessments and treatment strategies.

• Create and sustain security and compliance policies, procedures, and control documentation.

• Act as the primary contact for auditors and assessors during external audits and compliance evaluations.

• Manage vendor and third-party security risk assessments.

• Function as the organization’s Data Protection Officer (DPO) and provide guidance on privacy compliance, Data Protection Impact Assessments (DPIAs), data subject requests, and communications with supervisory authorities.

• Assist in customer security and compliance due diligence for federal and defense opportunities.

• Supervise security awareness and compliance training initiatives.

• Manage and enhance Vanta compliance tools, integrations, monitoring, and workflows for evidence collection.

• Drive ongoing control activities, which include access reviews, incident response drills, and business continuity and recovery tests.

• Communicate compliance status, audit outcomes, remediation advancements, and certification preparedness to leadership.

⛳️ Requirements

• A minimum of 5 years of experience in Governance, Risk, and Compliance (GRC), information security compliance, or auditing, with direct responsibility for security compliance programs and remediation initiatives.

• Proven track record in obtaining and sustaining agency-specific Authorizations to Operate (ATOs), including preparing authorization packages, addressing assessment findings, and managing ongoing compliance and continuous monitoring obligations.

• Practical experience with administering Vanta or a similar GRC platform, including setting up scope, control mappings, integrations, and automated evidence collection.

• Ability to directly assess cloud configurations, Identity and Access Management (IAM), logging, and operational workflows; gather and verify evidence from source systems; and evaluate the design and operational effectiveness of controls.

• Demonstrated experience managing SOC 2 examinations and/or ISO 27001 certification audits from the scoping and readiness phase through to completion and addressing findings.

• Strong working knowledge of CMMC, NIST SP 800-171, Risk Management Framework (RMF), and relevant STIGs, including the ability to translate requirements into controls, evidence, and remediation actions.

• Solid understanding of GDPR and the California Privacy Rights Act (CPRA), with practical experience in advising on privacy compliance, maintaining processing records, and supporting DPIAs and data subject requests.

• A degree in information security, computer science, information systems, or a related field, or equivalent practical experience.

• Preferred relevant professional certifications such as CCA, CCP, CRISC, CISM, or CISSP.

• Prior experience as an Information System Security Manager (ISSM) or Information System Security Officer (ISSO) is highly desirable.

🏝️ Benefits

• Competitive salary and performance-based bonuses.

• Comprehensive health, dental, and vision insurance.

• Flexible working hours and remote work options.

• Opportunities for professional development and continuous learning.

• Supportive work culture with a focus on teamwork and collaboration.