mechanicalorchard - Mechanical Orchard - Senior Compliance Specialist
Requirements
• 5+ years of experience in GRC, information security compliance, or audit, including direct ownership of security compliance programs and remediation efforts. • Proven experience obtaining and maintaining agency-specific ATOs, including preparing authorization packages, addressing assessment findings, and managing ongoing compliance and continuous monitoring requirements. Prior experience as an ISSM or ISSO is strongly preferred. • Hands-on experience administering Vanta or a comparable GRC platform, including configuring scope, control mappings, integrations, and automated evidence collection. • Ability to directly inspect cloud configurations, IAM, logging, and operational workflows; collect and validate evidence from source systems; and assess control design and operating effectiveness. • Demonstrated experience leading SOC 2 examinations and/or ISO 27001 certification audits from scoping and readiness through completion and remediation of findings. • Strong working knowledge of CMMC, NIST SP 800-171, RMF, and applicable STIGs, including translating requirements into controls, evidence, and remediation actions. • Strong knowledge of GDPR and CPRA, with practical experience advising on privacy compliance, maintaining processing records, and supporting DPIAs and data subject requests. • Degree in information security, computer science, information systems, or a related field, or equivalent practical experience. • Relevant professional certifications, such as CCA, CCP, CRISC, CISM, or CISSP, are preferred.
Responsibilities
• Own the day-to-day operation and continuous improvement of our ISO 27001, SOC 2, and GDPR compliance programs, including maintaining program scope, tracking compliance obligations, scheduling required reviews, maintaining documentation, and ensuring audit readiness. Directly inspect systems and workflows, assess control effectiveness, and collect and validate evidence from CSPs and internal systems. • Lead the internal audit program, including planning and conducting audits, documenting findings, and verifying corrective actions, while ensuring auditor objectivity and independence. • Lead our pursuit of CMMC certification, agency-specific ATOs, and compliance with applicable NIST SP 800-171 and other federal and defense requirements. Define scope, assess existing controls, identify gaps, and drive remediation through assessment and authorization readiness. Identify applicable STIGs, assess configurations and supporting evidence, and work with technical teams to implement and verify required changes. Develop and maintain SSPs, POA&Ms, and supporting assessment and authorization documentation. • Lead our enterprise risk management program, including chairing risk committee meetings, maintaining the risk register, and facilitating assessment of security, compliance, and other business risks. Work with risk owners to define and track treatment actions, verify mitigation evidence, and bring decisions requiring risk acceptance or prioritization to leadership. • Develop and maintain security and compliance policies, procedures, and control documentation, and drive policy review and approval. Work with relevant teams to verify that documentation reflects actual systems and practices, identify gaps between policy and implementation, and drive updates as requirements and business needs evolve. • Lead external audits and compliance assessments, serving as the primary contact for auditors and assessors. Prepare and validate evidence submissions, explain control implementation, resolve assessment questions, and drive findings through remediation and verified closure. • Oversee the vendor and third-party security risk review process, maintaining assessment criteria and ensuring reviews are completed and documented by the responsible teams. Track identified risks and remediation commitments, and escalate issues requiring risk acceptance or further action. • Serve as the organization’s DPO, advising on and monitoring privacy compliance in partnership with Legal and relevant teams. Maintain processing records, review data handling and retention practices, advise on DPIAs, coordinate responses to data subject requests, track remediation of privacy compliance gaps, and serve as the contact for supervisory authorities. • Support customer security and compliance due diligence, particularly for federal and defense opportunities. Contribute responses and evidence for requirements involving CMMC, NIST SP 800-171, and other applicable frameworks, and help evaluate proposed compliance commitments in partnership with InfoSec, Sales, and Legal. • Own and optimize our compliance tooling, currently Vanta, including configuring program scope, control mappings, integrations with CSPs and internal systems, and evidence collection workflows. Investigate and resolve integration and monitoring issues, validate collected evidence against source systems, and improve automation to reduce manual effort and ensure our tooling accurately reflects day-to-day compliance status. • Own and drive recurring compliance control activities, including access reviews, incident response exercises, and business continuity and recovery tests. Work with responsible teams to ensure activities are completed, validate supporting evidence, and track resulting findings through remediation. • Report compliance status, audit findings, remediation progress, and certification readiness to leadership. Highlight material gaps, upcoming obligations, and decisions or resources needed to keep existing programs effective and advance new compliance objectives.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT