Senior Compliance & Information Security Leader

Mechanical Orchard, Inc.; Oregon; Hybrid; USD 120,000 - 180,000; Full time

Job summary

Mechanical Orchard, Inc. is seeking a senior GRC and security compliance lead to own ISO 27001, SOC 2, GDPR programs and drive audit readiness across the organization in Oregon.

You will coordinate internal audits, manage external assessments including CMMC and NIST SP 800-171, and partner with Legal and IT to implement controls and evidence collection. You will develop policies, SSPs, and risk management processes, oversee Vanta tooling, and guide privacy initiatives, DPIAs, and data subject

Qualifications

• Own security compliance programs and remediation.
• Experience obtaining agency ATOs and managing continuous monitoring.
• Hands-on with GRC tooling and evidence collection.

Responsibilities

• Own ISO 27001, SOC 2, and GDPR compliance programs; audit readiness and evidence collection.
• Lead internal audits, document findings, and verify corrective actions.
• Drive CMMC, agency ATOs, and NIST SP 800-171 compliance with gaps and remediation.
• Develop and maintain SSPs, POA&Ms, and related docs.
• Lead enterprise risk management, maintain risk register, drive mitigation evidence.
• Develop security and compliance policies and control documentation.
• Coordinate external audits and assessments; assist auditors with evidence submissions.
• Oversee third-party security risk reviews and tracking of remediation.
• Serve as DPO or privacy liaison; respond to data subject requests and DPIAs.
• Support federal opportunities, align with FISMA/defense frameworks.
• Lead security awareness training and ensure evidence of completion.
• Manage compliance tooling (Vanta) configurations and automation.
• Oversee recurring control activities like access reviews and incident response exercises.
• Report compliance status and remediation progress to leadership.

Skills

GRC experience

Information security

Audit experience

Agency ATOs

ISSM/ISSO experience

Education

Degree in information security

Tools

Vanta

Job description

Mechanical Orchard, Inc. is seeking a senior GRC and security compliance lead to own ISO 27001, SOC 2, GDPR programs and drive audit readiness across the organization in Oregon.

You will coordinate internal audits, manage external assessments including CMMC and NIST SP 800-171, and partner with Legal and IT to implement controls and evidence collection. You will develop policies, SSPs, and risk management processes, oversee Vanta tooling, and guide privacy initiatives, DPIAs, and data subject