Senior GRC Analyst – ISO27001 Certification Lead

TrueCommerce

. Build and run the ISO/IEC 27001:2022 certification plan, timeline, and milestones through the Stage 2 audit .

Posted 11/12/2026full-timeRemote • United StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in ISO/IEC 27001:2022 certification processes, risk assessment methodologies, and governance, risk, and compliance (GRC) frameworks. Proven ability to lead organizations through certification audits while effectively communicating with stakeholders and managing security programs.

Highest-signal resume keywords

ISO/IEC 27001 Lead Implementer CertificationISO/IEC 27001:2022 KnowledgeGRC ExperienceProgram Management SkillsRisk Assessment Methodology

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Information SecurityRisk ManagementComplianceISO/IEC 27001:2022ISO/IEC 27002:2022Policy WritingAudit ManagementRisk Treatment PlanningEvidence CollectionISMS Documentation

Soft Skills

Influencing Without AuthorityStakeholder EngagementCoachingCommunication

Tools & Technologies

GRC ToolingAI Tools

Certifications & Qualifications

ISO/IEC 27001 Lead Implementer Certification

Industry Keywords

ISO/IEC 27001 CertificationSOC 2PCI DSSNIST CSFInternal AuditNonconformitiesCorrective Action Plans

About the role

Key responsibilities & impact

Build and run the ISO/IEC 27001:2022 certification plan, timeline, and milestones through the Stage 2 audit
Report progress, risks, and decisions to the Sr Director of Information Security and executive sponsor
Assess the security program against ISO/IEC 27001:2022 clauses 4–10 and Annex A
Facilitate ISMS scope, organizational context, interested parties, and information security objectives
Design the ISMS risk methodology and run risk assessment and treatment with risk owners
Produce the Statement of Applicability, risk treatment plan, and required ISMS documentation
Work with control owners to close gaps and generate audit evidence
Set up repeatable evidence collection in GRC tooling using approved AI tools where appropriate
Deliver ISMS awareness and targeted briefings
Coordinate an independent internal audit and facilitate management review
Support certification body selection and coordinate Stage 1 and Stage 2 audits
Lead responses to nonconformities and corrective action plans
Transfer ISMS ownership to the designated internal owner with documentation, operating calendar, and surveillance-audit readiness plan
Support and coach the existing InfoSec analyst on related GRC activities
Build internal capability to operate the ISMS day to day

Requirements

What you’ll need

At least seven years of experience in information security, risk, or compliance, including at least four years in hands-on GRC roles
Bachelor’s degree in information security, information systems, business, or a related field, or equivalent practical experience
Led at least two organizations through initial ISO/IEC 27001 certification (Stage 1 and Stage 2) as the implementation lead, including at least one against the 2022 version
Current ISO/IEC 27001 Lead Implementer certification
Deep working knowledge of ISO/IEC 27001:2022 and ISO/IEC 27002:2022
Experience mapping ISO 27001 to SOC 2, PCI DSS, and NIST CSF
Experience working with accredited certification bodies, including responding to audit findings and nonconformities
Experience writing and rolling out policies, standards, and procedures
Strong program management skills
Ability to influence without authority and work effectively with executives, engineers, and non-technical stakeholders
Applicants must be authorized to work for any employer in the U.S.
No employment visa sponsorship or takeover of sponsorship available

Benefits

Comp & perks

Remote first and casual work environment
401k with 3.5% company match and vested after 2 years
20 PTO days
10 company holidays
1 birthday day off
1 Volunteer day
3 summer days
Medical, dental, vision and other life/health insurance plans
Paid parental leave
Wellness reimbursement program