Senior Compliance Specialist

Mechanical Orchard

. Own the day-to-day operation and continuous improvement of ISO 27001, SOC 2, and GDPR compliance programs.

Posted 10/14/2026full-timeRemote • United StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in managing ISO 27001, SOC 2, and GDPR compliance programs, with a strong focus on risk management, audit readiness, and continuous improvement. Proficient in leading audits, vendor security assessments, and maintaining compliance documentation while advising on privacy regulations.

Highest-signal resume keywords

ISO 27001 Compliance ManagementSOC 2 Examination LeadershipVanta GRC Platform AdministrationCMMC Certification PursuitNIST SP 800-171 Control Assessment

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

GRC Program ManagementAudit Planning and ExecutionControl Effectiveness AssessmentCompliance Documentation MaintenanceRisk Assessment and TreatmentCloud Configuration InspectionData Subject Request ManagementIncident Response ExercisesBusiness Continuity TestingPrivacy Compliance Advising

Soft Skills

LeadershipCommunicationCollaborationProblem-SolvingOrganizational Skills

Tools & Technologies

Vanta Compliance ToolGRC PlatformsSecurity Awareness Training ToolsCompliance Monitoring Tools

Certifications & Qualifications

CCACCPCRISCCISMCISSP

Industry Keywords

ISO 27001SOC 2GDPRCMMCNIST SP 800-171DPIAATOsSTIGsRisk Management FrameworkInformation Security Compliance

Tech Stack

Tools & technologies

Cloud

About the role

Key responsibilities & impact

Own the day-to-day operation and continuous improvement of ISO 27001, SOC 2, and GDPR compliance programs.
Maintain program scope, track compliance obligations, schedule reviews, maintain documentation, and ensure audit readiness.
Inspect systems and workflows, assess control effectiveness, and collect and validate evidence from CSPs and internal systems.
Lead the internal audit program, including planning and conducting audits, documenting findings, and verifying corrective actions.
Lead pursuit of CMMC certification, agency-specific ATOs, NIST SP 800-171, and other federal and defense requirements.
Define scope, assess controls, identify gaps, drive remediation, identify applicable STIGs, and maintain SSPs, POA&Ms, and authorization documentation.
Lead enterprise risk management, chair risk committee meetings, maintain the risk register, and facilitate risk assessments and treatment actions.
Develop and maintain security and compliance policies, procedures, and control documentation.
Lead external audits and compliance assessments as primary contact for auditors and assessors.
Oversee vendor and third-party security risk reviews.
Serve as the organization’s DPO and advise on privacy compliance, DPIAs, data subject requests, and supervisory-authority communications.
Support customer security and compliance due diligence for federal and defense opportunities.
Oversee security awareness and compliance training programs.
Own and optimize Vanta compliance tooling, integrations, monitoring, and evidence collection workflows.
Drive recurring control activities, including access reviews, incident response exercises, and business continuity and recovery tests.
Report compliance status, audit findings, remediation progress, and certification readiness to leadership.

Requirements

What you’ll need

5+ years of experience in GRC, information security compliance, or audit, including direct ownership of security compliance programs and remediation efforts.
Proven experience obtaining and maintaining agency-specific ATOs, including preparing authorization packages, addressing assessment findings, and managing ongoing compliance and continuous monitoring requirements.
Hands-on experience administering Vanta or a comparable GRC platform, including configuring scope, control mappings, integrations, and automated evidence collection.
Ability to directly inspect cloud configurations, IAM, logging, and operational workflows; collect and validate evidence from source systems; and assess control design and operating effectiveness.
Demonstrated experience leading SOC 2 examinations and/or ISO 27001 certification audits from scoping and readiness through completion and remediation of findings.
Strong working knowledge of CMMC, NIST SP 800-171, RMF, and applicable STIGs, including translating requirements into controls, evidence, and remediation actions.
Strong knowledge of GDPR and CPRA, with practical experience advising on privacy compliance, maintaining processing records, and supporting DPIAs and data subject requests.
Degree in information security, computer science, information systems, or a related field, or equivalent practical experience.
Relevant professional certifications such as CCA, CCP, CRISC, CISM, or CISSP are preferred.
Prior experience as an ISSM or ISSO is strongly preferred.