InfoSec Compliance Manager (ISO/SOC/CMMC)

Synack; Oregon; Hybrid; USD 150,000 - 180,000; Full time

Job summary

Synack is seeking an Information Security Compliance Manager with deep expertise in ISO, SOC, CMMC and FedRAMP. You will work with Product, Engineering and Operations to ensure proper security controls and monitoring are applied.

This role requires U.S. citizenship due to federal contract requirements. You’ll automate SSPs, POAMs, and align AI/agentic security with NIST AI RMF and ISO 42001 while guiding DevSecOps across Synack hosted services.

Qualifications

• 8+ years of IT Security Strategy, Risk Management, IT Audit and Compliance experience.
• Experience with security regulations, standards and frameworks including ISO27000, ISO42001, OWASP, SOC2, GDPR, CMMC, FedRAMP, and NIST.
• Excellent written and verbal communication with ability to convey risk to different audiences.

Responsibilities

• Automate generation of SSPs and related artifacts.
• Develop and maintain automated Plans of Action and Milestones (POAMs).
• Advance automation and AI adoption within Synack's Information Security operations.
• Own inventory and risk assessments of AI/agentic systems in line with NIST AI RMF and ISO 42001.
• Build automated evidence collection and control-drift around security controls.
• Communicate with stakeholders on security compliance and track remediation tasks.
• Codify security controls into IaC guardrails, CNAPP policies, and CI/CD checks.
• Collaborate with Project Managers and Software Engineers to enforce DevSecOps policies.

Skills

IT security strategy

Risk management

IT audit

Compliance

Python

Terraform

CI/CD

GRC tools

Datadog

Stackdriver

Azure Sentinel

SOAR

SIEM query languages

CNAPP

SDLC

Secrets management

NIST

ISO27000

ISO42001

OWASP

SOC2

GDPR

CMMC

FedRAMP

Tools

Python

Terraform

CI/CD tools

Job description

Synack is seeking an Information Security Compliance Manager with deep expertise in ISO, SOC, CMMC and FedRAMP. You will work with Product, Engineering and Operations to ensure proper security controls and monitoring are applied.

This role requires U.S. citizenship due to federal contract requirements. You’ll automate SSPs, POAMs, and align AI/agentic security with NIST AI RMF and ISO 42001 while guiding DevSecOps across Synack hosted services.