GRC & Information Security Lead (ISO 27001, SOC 2)

WhiteBIT; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

24 calendar days of paid leave

Additional days off for national holyd

Job summary

WhiteBIT is hiring for a senior GRC/Information Security leader to own day-to-day GRC activities across information security, risk management, compliance, and assurance. You will conduct risk assessments, document gaps, and drive remediation in alignment with ISO 27001, SOC 2, PCI DSS, and other standards.

Collaborating with Security, IT, Legal, and Procurement, you will translate regulatory requirements into practical controls and support audits and certification efforts.

Qualifications

• 4–6+ years of experience in Information Security, GRC, Risk Management, Compliance, IT Audit, or related field.
• Experience with ISO 27001, SOC 2, PCI DSS, CCSS or similar frameworks.
• Familiarity with GDPR, NIS2, DORA or other regulations.
• Ability to translate regulatory requirements into actionable controls.

Responsibilities

• Own and coordinate day-to-day GRC activities across information security, risk management, compliance, and assurance.
• Conduct information security risk assessments, document risks, and track remediation actions.
• Support implementation and improvement of security frameworks (ISO 27001, SOC 2, PCI DSS).
• Coordinate internal and external audits, certifications, and regulatory reviews.
• Develop and maintain GRC metrics, dashboards, and reporting.

Skills

Information Security

GRC

Risk Management

Compliance

IT Audit

SaaS

Cloud governance

English proficiency

Education

CISA

CISM

CRISC

CISSP

ISO 27001 Lead Implementer

ISO 27001 Lead Auditor

Tools

ServiceNow GRC

OneTrust

Vanta

Drata

AuditBoard

Job description

WhiteBIT is hiring for a senior GRC/Information Security leader to own day-to-day GRC activities across information security, risk management, compliance, and assurance. You will conduct risk assessments, document gaps, and drive remediation in alignment with ISO 27001, SOC 2, PCI DSS, and other standards.

Collaborating with Security, IT, Legal, and Procurement, you will translate regulatory requirements into practical controls and support audits and certification efforts.