Information Security & Compliance Manager

CloudHQ, LLC; Ashburn (VA); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Competitive compensation

Comprehensive benefits (medical, etc.)

401(k) with match

12 paid holidays

Generous PTO

Job summary

CloudHQ, LLC is seeking an Information Security & Compliance Manager in Ashburn, VA to lead GRC, audits, and information security programs. You will oversee the ISMS, manage risk assessments, and coordinate remediation with cross-functional teams.

Reporting to the Director of Audit & Compliance, you will drive continual improvement, update policies, and coordinate certifications while guiding analysts and stakeholders across the organization.

Qualifications

• 7+ years of demonstrated professional experience in Governance, Risk, and Compliance (GRC), cybersecurity compliance, IT audit, risk management, or closely related functions.
• Minimum 5 years of hands-on experience with ISO 27001, SOC 1, SOC 2, and/or other recognized security, risk, or compliance frameworks.
• Hands-on experience using GRC platforms such as OneTrust, Hyperproof, RSA Archer, ServiceNow GRC, AuditBoard, LogicGate, or comparable GRC solutions.
• Minimum 3 years of demonstrated experience managing or directly supervising GRC, information security, audit, compliance, or related professionals.
• Proven leadership coaching and development of team members, including prioritization and workload management.
• Experience leading internal and external audits, certification activities, control assessments, risk assessments, and remediation programs.
• Experience translating framework, regulatory, and contractual requirements into practical controls.
• Strong knowledge of privacy, data protection, and applicable legal/regulatory requirements.

Responsibilities

• Manage day-to-day GRC, audit, information security compliance programs and related activities.
• Provide direct management and development to Information Security & Compliance Analysts.
• Lead audits, assessments, and remediation, ensuring audit readiness.
• Oversee ISMS and guidance for ISO 27001:2022, SOC 1, SOC 2, ISO 14001, ISO 50001.
• Coordinate documentation for certifications, attestations, customer requirements, and regulatory obligations.
• Partner with process owners to identify gaps, risks, and remediation plans.
• Maintain governance, risk, and compliance platforms, dashboards, and reporting.

Skills

GRC Leadership

InfoSec Leadership

ISO 27001 / SOC

Audit & Remediation

GRC Platforms

Team Management

Policy Development

Risk Management

Training & Awareness

Education

Bachelor’s degree

Tools

OneTrust

Hyperproof

RSA Archer

ServiceNow GRC

AuditBoard

LogicGate

Job description

Who We Are

Our purpose at CloudHQ is to provide flexible, efficient, and resilient data center solutions to businesses of all sizes. Our growing organization was founded by the pioneer of data center REITs. CloudHQ has state-of-the-art data center sites located on two Northern Virginia campuses, as well as London, Frankfurt, Paris, Milan, and São Paulo, and we anticipate exponential growth over the next several years both in the US and abroad. Our company’s reach is expanded through our affiliate companies – Cloud Capital, Dalian Development, and WindHQ.

Description

Who We Are

Our purpose at CloudHQ is to provide flexible, efficient, and resilient data center solutions to businesses of all sizes. Our growing organization was founded by the pioneer of data center REITs. CloudHQ has state-of-the-art data center sites located on two Northern Virginia campuses, as well as London, Frankfurt, Paris, Milan, and São Paulo, and we anticipate exponential growth over the next several years both in the US and abroad. Our company’s reach is expanded through our affiliate companies – Cloud Capital, Dalian Development, and WindHQ.

What The Role Entails

The Information Security & Compliance Manager is responsible for managing CloudHQ’s day-to-day Governance, Risk, and Compliance (GRC), information security, audit, and compliance activities.

Reporting to the Director of Audit & Compliance, this role provides leadership and oversight to the Information Security & Compliance team, manages compliance activities across the organization, leads audits and assessments, oversees risks and controls, and drives remediation and continual improvement.

The position supports CloudHQ’s compliance with ISO 27001:2022, SOC 1, SOC 2, ISO 14001, ISO 50001, and other applicable frameworks, regulatory requirements, and organizational standards.

What You Will Get To Do

• Manage the day-to-day execution and continual improvement of CloudHQ’s GRC, audit, information security compliance, and related programs
• Provide direct management, guidance, coaching, and professional development to Information Security & Compliance Analysts
• Assign and prioritize team activities, manage workload and deadlines, and review deliverables for quality, consistency, completeness, and audit readiness
• Serve as the primary escalation point for the analyst team on complex GRC, audit, risk, control, and compliance matters
• Manage and support CloudHQ’s Information Security Management System (ISMS) and compliance with ISO 27001:2022, SOC 1, SOC 2, and other applicable security and compliance frameworks
• Support the management and continual improvement of ISO 14001 and ISO 50001 programs, as applicable
• Lead and coordinate internal and external audits, certifications, attestations, and assessments, including planning, evidence collection, stakeholder coordination, audit responses, findings, and remediation
• Manage risk assessments, control assessments, internal audits, gap assessments, and compliance reviews
• Work directly with business and technical process owners to evaluate controls, identify gaps and risks, and establish practical remediation plans
• Manage audit findings, non-conformities, risks, corrective actions, and remediation activities through closure, escalating significant or overdue matters as appropriate
• Oversee the administration, governance, and effective use of GRC platforms, including risk registers, control libraries, assessments, audit evidence, findings, remediation workflows, dashboards, and compliance reporting
• Establish consistent and repeatable GRC processes, methodologies, workflows, documentation, and reporting across the organization
• Lead the development, review, implementation, and maintenance of policies, standards, procedures, controls, and related compliance documentation
• Coordinate documentation and evidence required to support certifications, attestations, customer requirements, internal and external audits, and regulatory obligations
• Provide GRC, audit, risk, control, and compliance guidance to business and technical teams
• Monitor changes to applicable standards, regulatory requirements, contractual obligations, and industry practices and coordinate necessary updates to compliance activities
• Prepare and present compliance, risk, audit, findings, and remediation status to management and the ISO Steering Committee.
• Support security and compliance awareness and training initiatives
• Identify opportunities for automation, standardization, and process improvements that increase the efficiency, consistency, and effectiveness of GRC activities
• Escalate significant compliance gaps, risks, control deficiencies, and unresolved remediation activities to the Director of Audit & Compliance

Requirements

What You Will Bring to The Role

• Minimum 7 years of demonstrated professional experience in Governance, Risk, and Compliance (GRC), cybersecurity compliance, IT audit, risk management, or closely related functions
• Minimum 5 years of demonstrated hands-on experience with ISO 27001, SOC 1, SOC 2, and/or other recognized security, risk, or compliance frameworks
• Minimum 5 years of demonstrated hands-on experience using GRC platforms such as OneTrust, Hyperproof, RSA Archer, ServiceNow GRC, AuditBoard, LogicGate, or comparable GRC solutions
• Minimum 3 years of demonstrated experience managing or directly supervising GRC, information security, audit, compliance, or related professionals
• Demonstrated experience leading, coaching, and developing team members, including assigning priorities, managing workload, reviewing deliverables, and supporting professional development
• Demonstrated experience leading internal and external audits, certification activities, control assessments, risk assessments, and remediation programs
• Experience managing relationships with internal and external auditors, process owners, control owners, technical teams, and other stakeholders
• Experience managing risks, controls, assessments, findings, corrective actions, and compliance reporting
• Experience developing and maintaining policies, standards, procedures, control documentation, and compliance evidence
• Experience coordinating multiple compliance frameworks, audits, assessments, and remediation activities simultaneously
• Advanced working knowledge of ISO 27001, SOC 1, SOC 2, and related control environments
• Strong knowledge of GRC principles, information security risk management, control design and effectiveness, audit methodologies, corrective actions, and continual improvement
• Strong experience with GRC platforms and the management of risk registers, control libraries, assessments, evidence, findings, remediation workflows, dashboards, and reporting
• Demonstrated leadership and people-management skills, including coaching, prioritization, delegation, performance management, and team development
• Ability to manage multiple audits, certifications, assessments, risks, and remediation activities across different business functions and locations
• Ability to translate framework, audit, regulatory, and contractual requirements into practical controls and business processes
• Understanding of privacy, data protection, and applicable legal and regulatory requirements
• Knowledge of ISO 14001 and ISO 50001 is preferred; direct experience is a plus
• Strong analytical and problem-solving skills with the ability to assess risk and recommend practical solutions
• Strong project management, organizational, and prioritization skills
• Strong written, verbal, and presentation skills, including the ability to communicate effectively with technical teams, process owners, auditors, and management
• Ability to lead cross-functional compliance initiatives and drive timely completion of agreed remediation activities
• Ability to exercise sound professional judgment and appropriately escalator significant risks or compliance concerns
• Strong attention to documentation quality, evidence integrity, traceability, and audit readiness
• Ability to operate effectively in a fast-paced and evolving environment
• Proficiency with Microsoft Office applications, including Excel, Word, PowerPoint, Outlook, and Teams

Our Ideal Candidate Will Also Possess

• Bachelor’s degree in a related field, preferred
• Relevant professional certifications such as ISO 27001 Lead Auditor/Lead Implementer, CISA, CRISC, CISM, CISSP, or equivalent GRC or information security credentials are strongly preferred
• ISO 14001 and ISO 50001 auditor credentials are also desirable

What We Offer

CloudHQ’s people and culture are the most enriching aspects that make us a great place to work. We are strengthened by industry experts who bring extensive knowledge, skill, and experience; leaders who bring vision, innovation and commitment to our people; and an expanding team of individuals who believe in that vision, and bring their best to support their customers and team. Our employees enjoy competitive compensation and rewarding incentives, comprehensive benefits (medical, dental, vision, life insurance, disability), 401(k) with match, 12 paid holidays, generous PTO, development opportunities, and the ability to closely impact and contribute to the growth of an exceptional organization.

Equal Employment Opportunity

CloudHQ is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, age, national origin, disability, sexual orientation, gender identity or expression, marital status, genetic information, protected veteran status, or other legally protected status.