Sr. Compliance Analyst (ISO 27001)

Location: Remote Based - US

Annual base salary: $120,000-$140,000, plus eligibility for an annual discretionary bonus.

Company

hirify.global provides cloud-based SaaS government software that helps government agencies improve efficiency, citizen engagement, service delivery, growth, and transparency.

What you will do

• Lead the end-to-end implementation and certification of the ISO/IEC 27001:2022 program, including implementation plans, milestones, deliverables, scope, objectives, and Statement of Applicability.
• Conduct gap assessments, manage risk assessments and treatment plans, implement and monitor controls, and coordinate remediation activities.
• Prepare for and coordinate external certification, surveillance, and recertification audits, including evidence collection, stakeholder interviews, findings remediation, and ongoing audit readiness.
• Develop and maintain information security policies, procedures, standards, ISMS documentation, records, control assessments, and compliance monitoring processes.
• Maintain ISO 27001 requirements, controls, risks, evidence, ownership, and remediation activities in the GRC platform, including Drata, and use automation to improve evidence collection and reporting.
• Collaborate with Information Security, IT, Engineering, Legal, HR, Finance, and other stakeholders; report on readiness, milestones, gaps, risks, dependencies, and remediation progress.

Requirements

• 5+ years of experience in GRC, information security compliance, security assurance, or a related field.
• Experience leading or substantially owning an ISO/IEC 27001 implementation and certification effort.
• Strong knowledge of ISO/IEC 27001:2022 requirements, ISMS operations, risk assessment and treatment, control implementation, and audit processes.
• Experience preparing for and coordinating external certification audits, including evidence management and remediation of findings.
• Experience developing and maintaining compliance policies, procedures, risk assessments, and control documentation.
• Hands-on experience with a GRC or compliance automation platform such as Drata or a comparable solution.
• Strong project management, analytical, organizational, communication, and stakeholder management skills, including independently managing complex initiatives and translating technical requirements into actionable business processes.
• Ability to influence cross-functional teams and drive accountability without direct reporting authority.
• ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CGRC, or comparable professional certification.
• Working knowledge of SOC 2 Type II, GovRAMP, NIST SP 800-53, CIS Controls, or PCI DSS.

Nice to have

• Bachelor's degree in Information Security, Cybersecurity, Information Technology, Risk Management, or a related field, or equivalent practical experience.
• Experience supporting GRC programs in a SaaS, cloud technology, or enterprise software environment.
• Familiarity with AWS or comparable cloud environments and associated security controls.
• Experience leveraging compliance automation platforms and integrating requirements across multiple compliance frameworks.

Culture & Benefits

• Remote position for U.S.-based team members.
• Flexible time off and comprehensive medical, dental, and vision plans.
• Family planning benefits, 401(k) retirement savings plan with company match, health savings account, and flexible spending account.
• Life, accident, disability, business travel insurance, employee assistance programs, and other well-being benefits.
• Commitment to diversity, equity, inclusion, psychological safety, belonging, and equal opportunity.