Sr GRC Analyst - ISO27001 Certification Lead (12-month contract)

Accountabilities

You will take ownership of the day-to-day certification program, coordinating stakeholders, managing implementation activities, and ensuring the organization is fully prepared for its initial ISO 27001 audit. Your responsibilities will include:

Develop and manage the end-to-end ISO/IEC 27001:2022 certification program, including the project plan, timeline, milestones, and deliverables from gap assessment through Stage 2 audit.

Report progress, risks, key decisions, and required actions to the Senior Director of Information Security and executive sponsor.

Assess the existing security program against ISO/IEC 27001:2022 clauses 4–10 and Annex A, identifying gaps and opportunities to reuse existing SOC 2 and PCI DSS controls and evidence.

Facilitate agreement with leadership on ISMS scope, organizational context, interested parties, and information security objectives.

Design an ISMS risk assessment and treatment methodology aligned with the existing risk register.

Coordinate risk assessments and treatment activities with designated risk owners, ensuring that risk acceptance decisions are formally documented and approved by the accountable owners.

Develop and maintain essential ISMS documentation, including the Statement of Applicability, risk treatment plan, policies, and procedures.

Update existing policies and procedures where possible rather than introducing unnecessary parallel documentation.

Work with control owners to implement required controls, address identified gaps, and ensure controls operate consistently long enough to generate appropriate Stage 2 audit evidence.

Establish repeatable evidence collection processes within approved GRC tools, using authorized AI tools where appropriate and validating all generated outputs.

Deliver ISMS awareness sessions for employees and targeted briefings for leadership, risk owners, and control owners.

Coordinate an independent internal audit, ensuring it is conducted by someone other than the implementation lead.

Prepare and facilitate the ISMS management review with top management.

Support the selection of an accredited certification body and coordinate the Stage 1 and Stage 2 certification audits.

Lead responses to audit nonconformities, coordinate corrective action plans, and monitor their resolution.

Complete the certification engagement by transferring ISMS ownership to the designated internal owner, including all documentation, an annual operating calendar, and a readiness plan for the first surveillance audit.

Provide secondary support to the existing Information Security analyst on related GRC activities, including risk register maintenance, policy reviews, third-party security assessments, and customer security questionnaires, according to priorities agreed with the Senior Director of Information Security.

Coach and develop internal team members so they can independently operate and maintain the ISMS after the contract ends.

Requirements

The ideal candidate is an experienced information security and GRC professional with a proven track record of delivering ISO 27001 certifications. They should combine deep technical knowledge of security frameworks with strong program management, stakeholder engagement, and implementation skills. The following qualifications are required:

At least 7 years of experience in information security, risk, or compliance, including a minimum of 4 years in hands-on Governance, Risk, and Compliance (GRC) roles.

Bachelor's degree in Information Security, Information Systems, Business, or a related field, or equivalent practical experience.

Proven experience leading at least 2 organizations through initial ISO/IEC 27001 certification, including both Stage 1 and Stage 2 audits, with at least one certification based on the 2022 version.

Current ISO/IEC 27001 Lead Implementer certification.

In-depth working knowledge of ISO/IEC 27001:2022 and ISO/IEC 27002:2022, including ISMS scoping, risk assessment and treatment, Statement of Applicability development, internal audits, and management reviews.

Experience mapping ISO 27001 requirements to other frameworks, such as SOC 2, PCI DSS, and NIST Cybersecurity Framework (CSF), to maximize control and evidence reuse.

Experience working with accredited certification bodies and managing audit findings, nonconformities, and corrective action processes.

Demonstrated ability to develop, document, and implement practical policies, standards, and procedures that teams can effectively follow.

Strong program and project management capabilities, with a track record of delivering compliance initiatives within fixed timelines.

Excellent communication and stakeholder management skills, including the ability to influence without direct authority.

Ability to collaborate effectively with executives, engineering teams, and technical and non-technical stakeholders.

Must be authorized to work for any employer in the United States. Visa sponsorship or transfer is not available for this role.

Additional qualifications that would be an advantage:

ISO/IEC 27001 Lead Auditor, CISA, CISM, CRISC, or CGRC certification.

Experience in SaaS, B2B platforms, or supply chain technology environments.

Hands-on experience with GRC platforms and AI-assisted approaches to evidence collection and documentation.

Familiarity with privacy and data protection regulations, including GDPR and CCPA, and their relationship to ISO 27001 controls.

Previous experience mentoring or developing junior GRC and information security professionals.

Benefits

Remote-first working environment with a casual workplace culture.

401(k) retirement plan with a 3.5% company match, vesting after 2 years.

20 days of paid time off.

10 company holidays.

One additional day off for your birthday.

One paid volunteer day.

Three additional summer days off.

Medical, dental, and vision insurance.

Additional life and health insurance plans.

Paid parental leave.

Wellness reimbursement program.

Fixed-term contract of approximately 12 months.

No mandatory travel.