Sr. Compliance Analyst

Jobgether; Oregon; Hybrid; USD 120,000 - 140,000; Full time

Benefits offered by this job

Base salary 120k–140k USD/yr

Annual bonus

Medical, dental, vision insurance

Flexible time off

401(k) with match

HSA with company contributions

FSA access

Life and disability insurance

Employee assistance program

Remote-friendly

Job summary

Jobgether partners with a client in the United States to hire a Sr. Compliance Analyst. The role centers on ISO/IEC 27001:2022 ISMS implementation, certification, and ongoing governance for a cloud-based environment. You will drive audits, remediation, and evidence collection while aligning with SOC 2 and GovRAMP requirements.

You will work with Information Security, IT, Legal, HR, and Finance to embed controls, maintain continuous audit readiness, and improve governance across the organization.

Qualifications

• 5+ years in GRC, information security compliance, or related field.
• Experience leading ISO 27001 implementation and certification.

Responsibilities

• Lead ISO 27001 implementation and certification programs.
• Coordinate external audits and evidence collection.
• Maintain ISMS scope, SoA, and documentation.
• Manage risks, controls, and remediation plans.
• Collaborate across Information Security, IT, Legal, HR, Finance.
• Align ISO 27001 with SOC 2 and other frameworks.
• Report certification readiness and progress to GRC Manager.

Skills

GRC governance & risk

Compliance program management

Audit & remediation

Policy development

Stakeholder management

Project management

Security frameworks knowledge

Education

Bachelor’s degree in Information Security or related field

Tools

Drata

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Sr. Compliance Analyst based in the United States. The Senior Compliance Analyst will lead the implementation, certification, and ongoing management of an ISO/IEC 27001:2022 Information Security Management System (ISMS). In this remote role, you will drive security compliance initiatives, coordinate certification audits, and strengthen risk management practices across a cloud-based software environment. You will collaborate with teams across information security, engineering, IT, legal, HR, and finance to embed effective controls and maintain continuous audit readiness. Combining hands-on compliance expertise with strong project management skills, you will oversee remediation plans, streamline evidence collection, and improve governance processes. You will also help align ISO 27001 requirements with existing SOC 2 controls and other relevant security frameworks. This is an opportunity to take ownership of a critical security program while contributing to the reliability, transparency, and trustworthiness of technology solutions serving public-sector organizations.

Accountabilities

• ISO 27001 Implementation and Certification: Lead the end-to-end implementation and certification of the ISO/IEC 27001:2022 program, establishing implementation plans, milestones, deliverables, and stakeholder responsibilities.
• Gap Assessments and Remediation: Assess existing practices against ISO 27001 requirements, identify compliance gaps, coordinate remediation activities, and track progress against established timelines.
• ISMS Management: Define and maintain the ISMS scope, objectives, and Statement of Applicability (SoA), ensuring that the management system remains aligned with organizational and certification requirements.
• Audit Coordination: Coordinate external certification, surveillance, and recertification audits, including preparation, evidence collection, stakeholder interviews, and resolution of audit findings.
• Risk Management and Controls: Conduct and maintain information security risk assessments, risk registers, and risk treatment plans. Work with control owners to implement, document, assess, and monitor applicable controls.
• Internal Audits and Continuous Improvement: Coordinate internal audits, management reviews, corrective actions, and ongoing improvement activities. Evaluate control effectiveness and ensure identified weaknesses are addressed.
• Policies and Documentation: Develop and maintain information security policies, procedures, standards, and supporting ISMS documentation. Ensure records are accurate, current, appropriately approved, and readily available for audits.
• GRC Platform Administration: Maintain requirements, risks, controls, evidence, and remediation activities within the governance, risk, and compliance (GRC) platform, including Drata or comparable tools.
• Evidence Management and Automation: Map existing controls and evidence to ISO 27001 requirements, establish clear ownership and monitoring processes, and leverage automation to streamline evidence collection and compliance reporting.
• Cross-Functional Collaboration: Partner with Information Security, IT, Engineering, HR, Legal, Finance, and other stakeholders to integrate compliance requirements into business processes and drive accountability across teams.
• Framework Alignment: Reuse existing SOC 2 controls and evidence where appropriate and support alignment with other frameworks, including GovRAMP, NIST SP 800-53, and PCI DSS.
• Program Reporting: Provide regular updates to the GRC Manager on certification readiness, milestones, risks, dependencies, compliance gaps, and remediation progress.

Requirements

• Professional Experience: At least 5 years of experience in governance, risk and compliance (GRC), information security compliance, security assurance, or a related field.
• ISO 27001 Implementation: Demonstrated experience leading or substantially owning an ISO/IEC 27001 implementation and certification initiative.
• Standards and ISMS Expertise: Strong knowledge of ISO/IEC 27001:2022 requirements, ISMS operations, risk assessment and treatment, control implementation, and audit processes.
• Audit Readiness: Experience preparing for and coordinating external certification audits, including evidence management, stakeholder coordination, and remediation of audit findings.
• Policies and Control Documentation: Proven ability to develop and maintain compliance policies, procedures, risk assessments, control documentation, and supporting records.
• GRC and Automation Tools: Hands‑on experience with a GRC or compliance automation platform, such as Drata or an equivalent solution.
• Project Management: Strong organizational, analytical, and project management skills, with the ability to independently manage complex initiatives, competing priorities, milestones, and deadlines.
• Communication and Stakeholder Management: Excellent communication skills, including the ability to translate technical security requirements into practical business processes and communicate expectations clearly to diverse stakeholders.
• Cross‑Functional Influence: Ability to build relationships, influence stakeholders, and drive accountability across teams without direct reporting authority.
• Professional Certifications: ISO/IEC 27001 Lead Implementer, ISO/IEC 27001 Lead Auditor, CISA, CGRC, or a comparable professional certification.
• Additional Security Frameworks: Working knowledge of SOC 2 Type II, GovRAMP, NIST SP 800-53, CIS Controls, or PCI DSS.

Preferred Qualifications

• A bachelor's degree in Information Security, Cybersecurity, Information Technology, Risk Management, or a related field, or equivalent practical experience.
• Experience supporting GRC programs in a SaaS, cloud technology, or enterprise software environment.
• Familiarity with AWS or comparable cloud environments and their associated security controls.
• Experience using compliance automation platforms and integrating requirements across multiple security and compliance frameworks.

Benefits

• Base Salary: $120,000-$140,000 annually, before applicable taxes. The final offer may vary based on location, education, skills, training, and experience.
• Annual Bonus: Eligibility for a discretionary annual bonus, with a target based on company and individual goal achievement.
• Medical, Dental, and Vision Insurance: Comprehensive healthcare plan options.
• Flexible Time Off: Flexible paid time off to support work-life balance.
• Retirement Savings: 401(k) retirement plan with a company match.
• Health Savings Account: HSA with company contributions.
• Flexible Spending Account: Access to an FSA for eligible expenses.
• Family Planning Benefits: Benefits designed to support family planning needs.
• Insurance Coverage: Life, accident, disability, and business travel insurance.
• Employee Assistance Program: Access to resources supporting personal well‑being.
• Additional Well‑Being Benefits: Other programs and resources designed to support employees' overall health and well‑being.
• Remote Work: Remote‑based position within the United States.
• Inclusive Workplace: Commitment to equal employment opportunities and consideration of reasonable accommodations for qualified candidates.

Commitment to equal employment opportunities and consideration of reasonable accommodations for qualified candidates.