Mechanical Orchard

Compliance

• Own the day-to-day operation and continuous improvement of ISO 27001, SOC 2, and GDPR compliance programs.
• Maintain program scope, track compliance obligations, schedule reviews, maintain documentation, and ensure audit readiness.
• Inspect systems and workflows, assess control effectiveness, and collect and validate evidence from CSPs and internal systems.
• Lead the internal audit program, including planning and conducting audits, documenting findings, and verifying corrective actions.
• Lead pursuit of CMMC certification, agency-specific ATOs, NIST SP 800-171, and other federal and defense requirements.
• Define scope, assess controls, identify gaps, drive remediation, identify applicable STIGs, and maintain SSPs, POA&Ms, and authorization documentation.
• Lead enterprise risk management, chair risk committee meetings, maintain the risk register, and facilitate risk assessments and treatment actions.
• Develop and maintain security and compliance policies, procedures, and control documentation.
• Lead external audits and compliance assessments as primary contact for auditors and assessors.
• Oversee vendor and third-party security risk reviews.
• Serve as the organization’s DPO and advise on privacy compliance, DPIAs, data subject requests, and supervisory-authority communications.
• Support customer security and compliance due diligence for federal and defense opportunities.
• Oversee security awareness and compliance training programs.
• Own and optimize Vanta compliance tooling, integrations, monitoring, and evidence collection workflows.
• Drive recurring control activities, including access reviews, incident response exercises, and business continuity and recovery tests.
• Report compliance status, audit findings, remediation progress, and certification readiness to leadership.

Explore Senior Compliance Specialist at Mechanical Orchard. Review requirements and application details.