ISO 27001 & GRC Security Compliance Leader

Careers; Los Angeles (CA); Hybrid; USD 195,000 - 215,000; Full time

Benefits offered by this job

Healthcare

401k plan

Paid holidays

PTO

Well-being programs

Professional development

Job summary

Latham & Watkins is seeking an Enterprise Security Compliance Manager in downtown Los Angeles to lead the firm’s security compliance program and coordinate responses to client security questionnaires, assessments, and RFPs. You will document controls, explain security architectures to assessors, and guide remediation with stakeholders.

The role sits within Global Security and Risk Management and supports a hybrid/in-office schedule.

Qualifications

• Bachelor's degree in a relevant field or equivalent security experience.
• Professional certifications (CISA, CISSP, CISM) preferred.
• 10+ years in GRC, risk, compliance, audit/cybersecurity assurance, governance, or resilience.
• 2+ years in a leadership role.
• Experience in a law practice setting preferred.

Responsibilities

• Lead the operation of the compliance governance processes, including control ownership, monitoring, issue tracking, and exception management.
• Coordinate penetration and vulnerability testing by engaging vendors and scheduling tests, then review results.
• Manage the firm’s security compliance communications, documentation, and evidence requests.
• Lead ISO 27001 certification efforts end-to-end from scoping to audit closure.
• Protect and maintain highly sensitive information and confidential data.

Skills

Leadership

Communication

GRC

Audit

Security governance

Risk management

Technical writing

Vendor management

Education

Bachelor's degree in Information Systems, Computer Science, Engineering, or related field

Job description

Latham & Watkins is seeking an Enterprise Security Compliance Manager in downtown Los Angeles to lead the firm’s security compliance program and coordinate responses to client security questionnaires, assessments, and RFPs. You will document controls, explain security architectures to assessors, and guide remediation with stakeholders.

The role sits within Global Security and Risk Management and supports a hybrid/in-office schedule.