Senior GRC Analyst – ISO27001 Certification Lead

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop and execute the ISO/IEC 27001:2022 certification strategy, including the timeline and milestones leading up to the Stage 2 audit.

• Communicate progress, risks, and decisions to the Senior Director of Information Security and the executive sponsor.

• Evaluate the security program in accordance with ISO/IEC 27001:2022 clauses 4–10 and Annex A.

• Facilitate the ISMS scope, organizational context, interested parties, and information security objectives.

• Create the ISMS risk methodology and conduct risk assessments and treatments with risk owners.

• Generate the Statement of Applicability, risk treatment plan, and necessary ISMS documentation.

• Collaborate with control owners to address gaps and produce audit evidence.

• Establish a repeatable evidence collection process in GRC tools, utilizing approved AI solutions as appropriate.

• Provide ISMS awareness training and targeted briefings.

• Organize an independent internal audit and facilitate the management review process.

• Assist in selecting a certification body and coordinate the Stage 1 and Stage 2 audits.

• Lead initiatives to address nonconformities and implement corrective action plans.

• Transition ISMS ownership to the assigned internal owner, along with documentation, an operational calendar, and a surveillance-audit readiness plan.

• Mentor and support the existing InfoSec analyst in related GRC activities.

• Develop internal capabilities to manage the ISMS on a daily basis.

⛳️ Requirements

• A minimum of seven years of experience in information security, risk management, or compliance, with at least four years in hands-on GRC roles.

• A Bachelor’s degree in information security, information systems, business, or a related discipline, or equivalent practical experience.

• Experience leading at least two organizations through the initial ISO/IEC 27001 certification process (Stage 1 and Stage 2) as the implementation lead, including at least one using the 2022 version.

• Possession of a current ISO/IEC 27001 Lead Implementer certification.

• Extensive working knowledge of ISO/IEC 27001:2022 and ISO/IEC 27002:2022.

• Experience linking ISO 27001 to SOC 2, PCI DSS, and NIST CSF.

• Familiarity with accredited certification bodies, including managing responses to audit findings and nonconformities.

• Proven experience in drafting and implementing policies, standards, and procedures.

• Strong program management skills.

• Capability to influence without formal authority and effectively collaborate with executives, engineers, and non-technical stakeholders.

• Candidates must be authorized to work for any employer in the U.S.

• Employment visa sponsorship or takeover of sponsorship is not available.

🏝️ Benefits

• A remote-first and casual work environment.

• 401k plan with a 3.5% company match, vested after two years.

• 20 days of paid time off (PTO).

• 10 company-recognized holidays.

• One day off for your birthday.

• One volunteer day.

• Three additional summer days off.

• Medical, dental, vision, and various life/health insurance plans.

• Paid parental leave.

• Wellness reimbursement program.