Senior Compliance Specialist

ecfirst; United States; Teletrabalho; USD 140 000 - 190 000; Tempo integral

Resumo da oferta

ecfirst, Inc. is seeking a Sr. Compliance Professional to lead and support compliance assessment, readiness, and program management across regulated industries.

You will design and maintain policies, guide remediation, and work with leadership to communicate risk to executives and technical teams. The role covers a wide range of frameworks including CMMC, NIST SP 800-171, HITRUST CSF, HIPAA, SOC 2, ISO 27001, and GDPR, with responsibilities spanning SSP/POA&M development, audits, and

Qualificações

• Bachelor's degree in Information Systems, Cybersecurity, Law, Business or related field.
• 5+ years of experience in compliance, GRC, audit, or IT risk management roles.
• Hands-on experience leading assessments against CMMC Level 2 / NIST SP 800-171, HITRUST CSF, and HIPAA; working knowledge of SOC 2, NIST CSF / SP 800-53, ISO 27001, PCI DSS, GDPR, and CCPA.
• Experience developing SSPs, POA&Ms, risk registers, remediation plans, and policies.
• Experience managing projects or engagements, including scope, budgets, schedules, and multiple concurrent deliverables.

Responsabilidades

• Develop, implement, and maintain compliance programs across frameworks and regulations (e.g., CMMC, NIST SP 800-171, NIST CSF / SP 800-53, HITRUST, HIPAA, SOC 2, ISO 27001, PCI DSS, GDPR, CCPA).
• Perform risk assessments, gap analyses, and audits; maintain risk registers and remediation plans.
• Coordinate with stakeholders, assessors, and external auditors for readiness reviews, valid assessments, certifications, and reporting.
• Monitor regulatory and framework changes and advise leadership on evolving obligations.
• Develop and maintain security, privacy, and compliance policies aligned to requirements.
• Lead CMMC Level 2 readiness engagements, HITRUST, HIPAA risk assessments, and cross-framework advisory.

Conhecimentos

Regulatory compliance

Risk assessment

Communication to execs

Engagement management

Formação académica

Bachelor's degree in Information Systems, Cybersecurity, Law, Business

Ferramentas

MyCSF

Descrição da oferta de emprego

Reports to: Director of Compliance

Type: Full-time | Remote

Position Summary

The Sr. Compliance Professional will lead and support compliance assessment, readiness, and program management efforts across regulated industries, including the Defense Industrial Base, healthcare, technology, higher education, manufacturing, and financial services. This role ensures compliance with regulatory, legal, and framework requirements by assessing controls, designing and maintaining policies and processes, and guiding organizations from gap identification through remediation and certification.

The ideal candidate brings deep, hands-on knowledge of compliance frameworks such as CMMC, NIST SP 800-171, HITRUST CSF, HIPAA, SOC 2, ISO 27001, and GDPR, along with proven ability to own engagements end to end, translate control gaps into practical remediation roadmaps, and communicate risk clearly to executive and technical audiences.

Key Responsibilities

Compliance Program Management

• Develop, implement, and maintain compliance programs across applicable frameworks and regulations (e.g., CMMC, NIST SP 800-171, NIST CSF / SP 800-53, HITRUST, HIPAA, SOC 2, ISO 27001, PCI DSS, GDPR, CCPA).
• Perform risk assessments, gap analyses, and audits to identify non-compliance or improvement opportunities, and maintain risk registers and remediation plans.
• Coordinate with internal stakeholders, assessors, and external auditors for readiness reviews, validated assessments, certifications, recertifications, and reporting.
• Monitor regulatory and framework changes (e.g., NIST SP 800-171 Rev. 2 to Rev. 3, CMMC program updates, HITRUST CSF version changes) and advise leadership on evolving compliance obligations.
• Develop and maintain security, privacy, and compliance policies, procedures, and supporting documentation aligned to framework requirements.

Assessment & Readiness Engagements

• Lead CMMC Level 2 readiness engagements, including CUI and FCI scoping, asset categorization, boundary analysis, NIST SP 800-171 control testing, System Security Plan (SSP) and Plan of Action & Milestones (POA&M) development, SPRS scoring, and mock-assessment preparation.
• Lead HITRUST e1, i1, and r2 readiness and validated assessments, interim assessments, and rapid recertifications, including MyCSF administration, evidence evaluation, scoring, quality review, and submission support.
• Conduct HIPAA security and privacy risk assessments and provide cross-framework advisory across SOC 2, NIST, ISO 27001, GDPR, PCI DSS, and other controls-assurance requirements.
• Execute assessment fieldwork through stakeholder interviews, evidence requests, control testing, evidence evaluation, scoring, and workpaper development.
• Translate control gaps and findings into risk-based priorities, remediation roadmaps, and practical implementation guidance, and track remediation through to closure.
• Work with technical teams to turn compliance requirements into implementation actions and gather the evidence needed to demonstrate control effectiveness.

Engagement Leadership & Quality

• Own end-to-end engagement delivery, from scoping and work planning through assessment, remediation, executive reporting, and closeout, managing budgets, timelines, staffing, risks, and status.
• Serve as a primary client lead and escalation point, managing expectations and communicating status, risks, and next steps.
• Provide quality oversight by reviewing teamwork, resolving complex control-interpretation questions, and mentoring junior staff.
• Develop and standardize assessment methodologies, templates, workpapers, reports, and automation-enabled workflows.
• Support business development through proposals, statements of work, scoping, fee estimates, client pursuits, and industry speaking engagements.
• Develop and deliver compliance training programs, including role-based training, quizzes, and workshops, to ensure employee understanding of and adherence to compliance responsibilities.
• Generate metrics, reports, and executive presentations on compliance status, risks, and remediation progress for executive and board-level audiences.
• Collaborate cross-functionally with Cybersecurity, Legal, IT, HR, and Operations to embed compliance into organizational processes.

Qualifications

• Bachelor's degree in Information Systems, Cybersecurity, Law, Business, or a related field, or equivalent experience.
• 5+ years of experience in compliance, GRC, audit, or IT risk management roles.
• Hands-on experience leading assessments against CMMC Level 2 / NIST SP 800-171, HITRUST CSF, and HIPAA; working knowledge of SOC 2, NIST CSF / SP 800-53, ISO 27001, PCI DSS, GDPR, and CCPA.
• Demonstrated experience developing SSPs, POA&Ms, risk registers, remediation plans, and policies.
• Experience managing projects or engagements, including scope, budgets, schedules, and multiple concurrent deliverables.
• Strong analytical and problem-solving abilities, with attention to detail and documentation.
• Excellent written and verbal communication skills, with the ability to present findings to executive and technical stakeholders.

Preferred Qualifications

• One or more certifications such as CISA, CISM, CRISC, CIPP, CCSFP (HITRUST), CMMC CCP, or CMMC CCA.
• Experience leading or mentoring a team of 5+ and contributing to methodology or practice development.