Information Security & Compliance Senior Analyst

Cloudhq; Ashburn (VA); On-site; USD 120,000 - 150,000; Full time

Benefits offered by this job

Medical, dental, vision

Life insurance

Disability insurance

401(k) with match

Paid holidays

Generous PTO

Development opportunities

Job summary

CloudHQ is seeking a Senior Information Security & Compliance Analyst to support governance, risk, and compliance programs across ISO 27001:2022, SOC 1/2, ISO 14001, and ISO 50001. You will collaborate with process owners to strengthen controls and documentation.

This role requires independent execution of audits, evidence management, remediation tracking, and reporting to management, with a focus on continual ISMS improvement and audit readiness.

Qualifications

• 5+ years in GRC, cybersecurity compliance, IT audit, or risk management.
• Hands-on experience with ISO 27001, SOC 1/2, and related frameworks.
• Experience using multiple GRC platforms as listed.
• Experience conducting internal audits, control and risk assessments, remediation.
• Ability to translate requirements into practical controls and documentation.

Responsibilities

• Perform GRC, audit, risk, control, and compliance activities independently.
• Maintain ISMS and support continual improvement.
• Support ISO 27001:2022, SOC 1, SOC 2, and other frameworks.
• Support ISO 14001 and ISO 50001 program activities as applicable.
• Conduct internal audits, risk assessments, control assessments, gap assessments, and reviews.
• Support audits, certifications, attestations, evidence collection and remediation tracking.
• Work with owners to evaluate controls, identify gaps, and develop remediation actions.
• Track findings, non-conformities, risks, and remediation through closure.
• Maintain GRC platforms, risk registers, control libraries, and reporting.
• Develop, review, and maintain policies, standards, and documentation.
• Provide guidance to business and technical teams on GRC.
• Monitor compliance requirements and update controls and documentation.
• Prepare status information for management reporting.
• Support security and compliance awareness and training initiatives.
• Identify opportunities to standardize GRC processes and reporting.

Skills

GRC governance

ISO 27001

SOC 1/2

Audit

Risk assessment

Evidence management

GRC platforms

Communication

Education

Bachelor’s degree

Tools

OneTrust

Hyperproof

RSA Archer

ServiceNow GRC

AuditBoard

LogicGate

Job description

Description

Who We Are

Our purpose at CloudHQ is to provide flexible, efficient, and resilient data center solutions to businesses of all sizes. Our growing organization was founded by the pioneer of data center REITs. CloudHQ has state-of-the-art data center sites located on two Northern Virginia campuses, as well as London, Frankfurt, Paris, Milan, and São Paulo, and we anticipate exponential growth over the next several years both in the US and abroad. Our company’s reach is expanded through our affiliate companies – Cloud Capital, Dalian Development, and WindHQ.

What The Role Entails

The Senior Information Security & Compliance Analyst is a senior individual contributor supporting CloudHQ’s Governance, Risk, and Compliance (GRC), information security, audit, and compliance programs.

This role independently performs complex GRC activities, including risk and control assessments, internal audits, compliance assessments, evidence management, remediation tracking, and maintenance of compliance documentation.

The position works closely with the Information Security & Compliance Manager, Director of Audit & Compliance, and business and technical process owners to support compliance with ISO 27001:2022, SOC 1, SOC 2, ISO 14001, ISO 50001, and other applicable frameworks and requirements.

What You Will Get To Do

• Independently perform GRC, audit, risk, control, and compliance activities
• Support the maintenance and continual improvement of CloudHQ’s Information Security Management System (ISMS)
• Perform activities supporting ISO 27001:2022, SOC 1, SOC 2, and other applicable security and compliance frameworks
• Support ISO 14001 and ISO 50001 management system activities, as applicable
• Conduct internal audits, risk assessments, control assessments, gap assessments, and compliance reviews
• Support internal and external audits, certifications, and attestations, including evidence collection, documentation review, auditor requests, findings, and remediation
• Work directly with business and technical process owners to evaluate controls, identify gaps, and develop remediation actions
• Track audit findings, non-conformities, risks, corrective actions, and remediation activities through closure
• Maintain GRC platforms, including risk registers, control libraries, assessments, evidence, findings, remediation activities, and compliance reporting
• Develop, review, and maintain policies, standards, procedures, controls, and supporting compliance documentation
• Review evidence and documentation for completeness, accuracy, traceability, and audit readiness
• Provide GRC and compliance guidance to business and technical teams
• Monitor applicable compliance requirements and support updates to controls and documentation
• Prepare compliance, audit, risk, and remediation status information for management reporting
• Support security and compliance awareness and training initiatives
• Identify opportunities to improve and standardize GRC processes, documentation, workflows, and reporting
• Provide guidance and subject‑matter support to other analysts as needed

Requirements

What You Will Bring to The Role

• Minimum 5 years of professional experience demonstrated in Governance, Risk, and Compliance (GRC), cybersecurity compliance, IT audit, risk management, or closely related functions
• Minimum 5 years of demonstrated hands‑on experience with ISO 27001, SOC 1, SOC 2, and/or other recognized security, risk, or compliance frameworks
• Minimum 5 years of demonstrated hands‑on experience using GRC platforms such as OneTrust, Hyperproof, RSA Archer, ServiceNow GRC, AuditBoard, LogicGate, or comparable GRC solutions
• Demonstrated experience conducting internal audits, control assessments, risk assessments, gap assessments, and compliance reviews
• Experience supporting internal and external audits, certifications, and remediation activities
• Experience working directly with business and technical control owners to evaluate controls, collect evidence, identify gaps, and resolve findings
• Experience developing and maintaining policies, standards, procedures, controls, risk documentation, and compliance evidence
• Experience managing multiple assessments, findings, evidence requests, and remediation activities
• Strong working knowledge of ISO 27001, SOC 1, SOC 2, and related control environments
• Strong understanding of GRC principles, information security risk management, control design and effectiveness, audit methodologies, corrective actions, and continual improvement
• Strong hands‑on experience with GRC platforms and management of risks, controls, assessments, evidence, findings, and remediation activities
• Ability to independently perform internal audits, risk assessments, gap assessments, control reviews, and compliance assessments
• Ability to interpret framework requirements and translate them into practical controls and documentation
• Strong analytical and problem‑solving skills
• Strong documentation and evidence‑management skills with attention to accuracy, traceability, and audit readiness
• Ability to manage multiple priorities and assignments with limited supervision
• Strong written and verbal communication skills
• Ability to communicate effectively with technical teams, business process owners, auditors, and management
• Ability to provide guidance and subject‑matter support to other analysts without formal people‑management responsibility
• Knowledge of privacy, data protection, and applicable legal and regulatory requirements
• Knowledge of ISO 14001 and ISO 50001 is preferred
• Proficiency with Microsoft Office applications, including Excel, Word, PowerPoint, Outlook, and Teams

Our Ideal Candidate Will Also Possess

• Bachelor’s degree in a related field, preferred
• Relevant professional certifications such as ISO 27001 Lead Auditor/Lead Implementer, CISA, CRISC, CISM, CISSP, or equivalent GRC or information security credentials are strongly preferred
• ISO 14001 and ISO 50001 auditor credentials are also desirable

What We Offer

CloudHQ’s people and culture are the most enriching aspects that make us a great place to work. We are strengthened by industry experts who bring extensive knowledge, skill, and experience; leaders who bring vision, innovation and commitment to our people; and an expanding team of individuals who believe in that vision, and bring their best to support their customers and team.

Our employees enjoy competitive compensation and rewarding incentives, comprehensive benefits (medical, dental, vision, life insurance, disability), 401(k) with match, 12 paid holidays, generous PTO, development opportunities, and the ability to closely impact and contribute to the growth of an exceptional organization.

Equal Employment Opportunity

CloudHQ is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, age, national origin, disability, sexual orientation, gender identity or expression, marital status, genetic information, protected veteran status, or other legally protected status.