Information Security & Compliance Manager

CloudHQ LLC•Ashburn, VA

About The Position

The Information Security & Compliance Manager manages CloudHQ’s day-to-day Governance, Risk, and Compliance (GRC), information security, audit, and compliance activities. Reporting to the Director of Audit & Compliance, the role leads and oversees the Information Security & Compliance team, organization-wide compliance activities, audits and assessments, risks and controls, remediation, and continual improvement. The position supports compliance with ISO 27001:2022, SOC 1, SOC 2, ISO 14001, ISO 50001, and other applicable frameworks, regulatory requirements, and organizational standards. It also manages the ISMS and GRC processes and platforms, develops and maintains compliance documentation, coordinates with business and technical stakeholders and auditors, reports status to management and the ISO Steering Committee, and identifies opportunities to improve and automate GRC activities.

Requirements

At least 7 years of professional experience in GRC, cybersecurity compliance, IT audit, risk management, or closely related functions.
At least 5 years of hands-on experience with ISO 27001, SOC 1, SOC 2, and/or other recognized security, risk, or compliance frameworks.
At least 5 years of hands-on experience using GRC platforms such as OneTrust, Hyperproof, RSA Archer, ServiceNow GRC, AuditBoard, LogicGate, or comparable solutions.
At least 3 years of experience managing or directly supervising GRC, information security, audit, compliance, or related professionals.
Experience leading, coaching, and developing team members, including assigning priorities, managing workload, reviewing deliverables, and supporting professional development.
Experience leading internal and external audits, certification activities, control and risk assessments, and remediation programs.
Experience managing relationships with internal and external auditors, process owners, control owners, technical teams, and other stakeholders.
Experience managing risks, controls, assessments, findings, corrective actions, and compliance reporting.
Experience developing and maintaining policies, standards, procedures, controls, risk documentation, and compliance evidence.
Experience coordinating multiple compliance frameworks, audits, assessments, and remediation activities simultaneously.
Advanced working knowledge of ISO 27001, SOC 1, SOC 2, and related control environments.
Strong knowledge of GRC principles, information security risk management, control design and effectiveness, audit methodologies, corrective actions, and continual improvement.
Strong experience with GRC platforms and managing risk registers, control libraries, assessments, evidence, findings, remediation workflows, dashboards, and reporting.
Demonstrated leadership and people-management skills, including coaching, prioritization, delegation, performance management, and team development.
Ability to manage multiple audits, certifications, assessments, risks, and remediation activities across business functions and locations.
Ability to translate framework, audit, regulatory, and contractual requirements into practical controls and business processes.
Understanding of privacy, data protection, and applicable legal and regulatory requirements.
Strong analytical and problem-solving skills and the ability to assess risks and recommend practical solutions.
Strong project management, organizational, and prioritization skills.
Strong written, verbal, and presentation skills, including the ability to communicate effectively with technical teams, process owners, auditors, and management.
Ability to lead cross-functional compliance initiatives and drive timely completion of agreed remediation activities.
Ability to exercise sound professional judgment and appropriately escalate significant risks or compliance concerns.
Strong attention to documentation quality, evidence integrity, traceability, and audit readiness.
Ability to operate effectively in a fast-paced and evolving environment.
Proficiency with Microsoft Office applications, including Excel, Word, PowerPoint, Outlook, and Teams.

Nice To Haves

Bachelor’s degree in a related field is preferred.
Relevant professional certifications such as ISO 27001 Lead Auditor/Lead Implementer, CISA, CRISC, CISM, CISSP, or equivalent GRC or information security credentials are strongly preferred.
Knowledge of ISO 14001 and ISO 50001 is preferred; direct experience is a plus.
ISO 14001 and ISO 50001 auditor credentials are desirable.

Responsibilities

Manage the day-to-day execution and continual improvement of CloudHQ’s GRC, audit, information security compliance, and related programs.
Manage, guide, coach, and support the professional development of Information Security & Compliance Analysts; assign and prioritize work, manage deadlines, review deliverables, and serve as the team’s primary escalation point.
Manage CloudHQ’s Information Security Management System (ISMS) and support compliance with ISO 27001:2022, SOC 1, SOC 2, and other applicable security and compliance frameworks.
Support the management and continual improvement of ISO 14001 and ISO 50001 programs, as applicable.
Lead and coordinate internal and external audits, certifications, attestations, and assessments, including planning, evidence collection, stakeholder coordination, audit responses, findings, and remediation.
Manage risk assessments, control assessments, internal audits, gap assessments, and compliance reviews.
Work with business and technical process owners to evaluate controls, identify gaps and risks, and establish practical remediation plans.
Manage audit findings, non-conformities, risks, corrective actions, and remediation through closure, escalating significant or overdue matters as appropriate.
Oversee the administration, governance, and use of GRC platforms, including risk registers, control libraries, assessments, audit evidence, findings, remediation workflows, dashboards, and compliance reporting.
Establish consistent and repeatable GRC processes, methodologies, workflows, documentation, and reporting across the organization.
Lead the development, review, implementation, and maintenance of policies, standards, procedures, controls, and related compliance documentation.
Coordinate documentation and evidence for certifications, attestations, customer requirements, audits, and regulatory obligations.
Provide GRC, audit, risk, control, and compliance guidance to business and technical teams.
Monitor changes to applicable standards, regulatory requirements, contractual obligations, and industry practices and coordinate necessary updates to compliance activities.
Prepare and present compliance, risk, audit, findings, and remediation status to management and the ISO Steering Committee.
Support security and compliance awareness and training initiatives.
Identify opportunities for automation, standardization, and process improvements to increase GRC efficiency, consistency, and effectiveness.
Escalate significant compliance gaps, risks, control deficiencies, and unresolved remediation activities to the Director of Audit & Compliance.