Information Security & Compliance Manager

CloudHQ LLC; Ashburn (VA); Vor Ort; USD 120.000 - 180.000; Vollzeit

Benefits dieser Stelle

401(k) with match

12 paid holidays

Generous PTO

Development opportunities

Medical, dental, vision, life ins.

Zusammenfassung

CloudHQ LLC seeks an Information Security & Compliance Manager to lead GRC, information security compliance, audits, and remediation efforts. You will guide a team of analysts, coordinate ISO 27001:2022, SOC 1/2 activities, and drive continual improvement across the organization.

You will oversee ISMS, risk assessments, control libraries, and evidence management, while aligning with regulatory requirements and customer expectations. A strategic role with hands-on leadership responsibilities.

Qualifikationen

• Minimum 7 years of demonstrated professional experience in Governance, Risk, and Compliance (GRC) or closely related functions.
• Minimum 5 years of hands-on experience with ISO 27001, SOC 1, SOC 2, and/or other recognized security frameworks.
• Minimum 5 years of hands-on experience using GRC platforms such as OneTrust, Hyperproof, RSA Archer, ServiceNow GRC, AuditBoard, LogicGate, or comparable solutions.
• Minimum 3 years of supervising GRC, information security, audit, or compliance professionals.
• Demonstrated experience leading, coaching, and developing team members; prioritization and workload management.
• Experience leading internal and external audits, certifications, control assessments, risk assessments, and remediation programs.
• Experience coordinating multiple compliance frameworks, audits, assessments, and remediation activities simultaneously.
• Strong knowledge of GRC principles, information security risk management, and audit methodologies.
• Ability to translate framework and regulatory requirements into practical controls and processes.
• Understanding of privacy and data protection requirements; ISO 14001/ISO 50001 preferred.

Aufgaben

• Manage day-to-day GRC, audit, and information security compliance programs and improvements.
• Provide leadership, coaching, and development to Information Security & Compliance Analysts.
• Lead audits, certifications, attestations, and remediation activities; coordinate with stakeholders.
• Maintain ISMS and compliance with ISO 27001:2022, SOC 1/2, and related frameworks.
• Oversee documentation, evidence collection, and audit readiness across the organization.
• Develop and maintain policies, standards, procedures, and risk documentation.
• Coordinate with process owners to implement practical remediation plans.
• Report findings and remediation status to management and ISO Steering Committee.
• Promote awareness and training on security and compliance.

Kenntnisse

GRC governance

Audits & assessments

Risk management

Leadership & coaching

Policy development

Documentation & audit readiness

Stakeholder management

Compliance governance

Continuous improvement

Regulatory awareness

Ausbildung

Bachelor’s degree (related field)

ISO 27001 Lead Auditor / Lead Implementer certification

CISA / CRISC / CISM / CISSP certification preferred

ISO 14001/ISO 50001 auditor credentials desirable

Tools

OneTrust

Hyperproof

RSA Archer

ServiceNow GRC

AuditBoard

LogicGate

Jobbeschreibung

Description

Who We Are

Our purpose at CloudHQ is to provide flexible, efficient, and resilient data center solutions to businesses of all sizes. Our growing organization was founded by the pioneer of data center REITs. CloudHQ has state-of-the-art data center sites located on two Northern Virginia campuses, as well as London, Frankfurt, Paris, Milan, and São Paulo, and we anticipate exponential growth over the next several years both in the US and abroad. Our company’s reach is expanded through our affiliate companies – Cloud Capital, Dalian Development, and WindHQ.

What The Role Entails

The Information Security & Compliance Manager is responsible for managing CloudHQ’s day-to-day Governance, Risk, and Compliance (GRC), information security, audit, and compliance activities.

Reporting to the Director of Audit & Compliance, this role provides leadership and oversight to the Information Security & Compliance team, manages compliance activities across the organization, leads audits and assessments, oversees risks and controls, and drives remediation and continual improvement.

The position supports CloudHQ’s compliance with ISO 27001:2022, SOC 1, SOC 2, ISO 14001, ISO 50001, and other applicable frameworks, regulatory requirements, and organizational standards.

What You Will Get To Do

• Manage the day-to-day execution and continual improvement of CloudHQ’s GRC, audit, information security compliance, and related programs
• Provide direct management, guidance, coaching, and professional development to Information Security & Compliance Analysts
• Assign and prioritize team activities, manage workload and deadlines, and review deliverables for quality, consistency, completeness, and audit readiness
• Serve as the primary escalation point for the analyst team on complex GRC, audit, risk, control, and compliance matters
• Manage and support CloudHQ’s Information Security Management System (ISMS) and compliance with ISO 27001:2022, SOC 1, SOC 2, and other applicable security and compliance frameworks
• Support the management and continual improvement of ISO 14001 and ISO 50001 programs, as applicable
• Lead and coordinate internal and external audits, certifications, attestations, and assessments, including planning, evidence collection, stakeholder coordination, audit responses, findings, and remediation
• Manage risk assessments, control assessments, internal audits, gap assessments, and compliance reviews
• Work directly with business and technical process owners to evaluate controls, identify gaps and risks, and establish practical remediation plans
• Manage audit findings, non-conformities, risks, corrective actions, and remediation activities through closure, escalating significant or overdue matters as appropriate
• Oversee the administration, governance, and effective use of GRC platforms, including risk registers, control libraries, assessments, audit evidence, findings, remediation workflows, dashboards, and compliance reporting
• Establish consistent and repeatable GRC processes, methodologies, workflows, documentation, and reporting across the organization
• Lead the development, review, implementation, and maintenance of policies, standards, procedures, controls, and related compliance documentation
• Coordinate documentation and evidence required to support certifications, attestations, customer requirements, internal and external audits, and regulatory obligations
• Provide GRC, audit, risk, control, and compliance guidance to business and technical teams
• Monitor changes to applicable standards, regulatory requirements, contractual obligations, and industry practices and coordinate necessary updates to compliance activities
• Prepare and present compliance, risk, audit, findings, and remediation status to management and the ISO Steering Committee.
• Support security and compliance awareness and training initiatives
• Identify opportunities for automation, standardization, and process improvements that increase the efficiency, consistency, and effectiveness of GRC activities
• Escalate significant compliance gaps, risks, control deficiencies, and unresolved remediation activities to the Director of Audit & Compliance

Requirements

What You Will Bring to The Role

• Minimum 7 years of demonstrated professional experience in Governance, Risk, and Compliance (GRC), cybersecurity compliance, IT audit, risk management, or closely related functions
• Minimum 5 years of demonstrated hands‑on experience with ISO 27001, SOC 1, SOC 2, and/ou other recognized security, risk, or compliance frameworks
• Minimum 5 years of demonstrated hands‑on experience using GRC platforms such as OneTrust, Hyperproof, RSA Archer, ServiceNow GRC, AuditBoard, LogicGate, or comparable GRC solutions
• Minimum 3 years of demonstrated experience managing or directly supervising GRC, information security, audit, compliance, or related professionals
• Demonstrated experience leading, coaching, and developing team members, including assigning priorities, managing workload, reviewing deliverables, and supporting professional development
• Demonstrated experience leading internal and external audits, certification activities, control assessments, risk assessments, and remediation programs
• Experience managing relationships with internal and external auditors, process owners, control owners, technical teams, and other stakeholders
• Experience managing risks, controls, assessments, findings, corrective actions, and compliance reporting
• Experience developing and maintaining policies, standards, procedures, controls, risk documentation, and compliance evidence
• Experience coordinating multiple compliance frameworks, audits, assessments, and remediation activities simultaneously
• Advanced working knowledge of ISO 27001, SOC 1, SOC 2, and related control environments
• Strong knowledge of GRC principles, information security risk management, control design and effectiveness, audit methodologies, corrective actions, and continual improvement
• Strong experience with GRC platforms and the management of risk registers, control libraries, assessments, evidence, findings, remediation workflows, dashboards, and reporting
• Demonstrated leadership and people-management skills, including coaching, prioritization, delegation, performance management, and team development
• Ability to manage multiple audits, certifications, assessments, risks, and remediation activities across different business functions and locations
• Ability to translate framework, audit, regulatory, and contractual requirements into practical controls and business processes
• Understanding of privacy, data protection, and applicable legal and regulatory requirements
• Knowledge of ISO 14001 and ISO 50001 is preferred; direct experience is a plus
• Strong analytical and problem-solving skills with the ability to assess risk and recommend practical solutions
• Strong project management, organizational, and prioritization skills
• Strong written, verbal, and presentation skills, including the ability to communicate effectively with technical teams, process owners, auditors, and management
• Ability to lead cross-functional compliance initiatives and drive timely completion of agreed remediation activities
• Ability to exercise sound professional judgment and appropriately elevate significant risks or compliance concerns
• Strong attention to documentation quality, evidence integrity, traceability, and audit readiness
• Ability to operate effectively in a fast-paced and evolving environment
• Proficiency with Microsoft Office applications, including Excel, Word, PowerPoint, Outlook, and Teams

Our Ideal Candidate Will Also Possess

• Bachelor’s degree in a related field, preferred
• Relevant professional certifications such as ISO 27001 Lead Auditor/Lead Implementer, CISA, CRISC, CISM, CISSP, or equivalent GRC or information security credentials are strongly preferred
• ISO 14001 and ISO 50001 auditor credentials are also desirable

What We Offer

CloudHQ’s people and culture are the most enriching aspects that make us a great place to work. We are strengthened by industry experts who bring extensive knowledge, skill, and experience; leaders who bring vision, innovation and commitment to our people; and an expanding team of individuals who believe in that vision, and bring their best to support their customers and team.

Our employees enjoy competitive compensation and rewarding incentives, comprehensive benefits (medical, dental, vision, life insurance, disability), 401(k) with match, 12 paid holidays, generous PTO, development opportunities, and the ability to closely impact and contribute to the growth of an exceptional organization.

Equal Employment Opportunity

CloudHQ is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, age, national origin, disability, sexual orientation, gender identity or expression, marital status, genetic information, protected veteran status, or other legally protected status.