Information Security & Compliance Manager

CloudHQ • Ashburn, VA

5d

About The Position

The Information Security & Compliance Manager manages CloudHQ’s day-to-day Governance, Risk, and Compliance (GRC), information security, audit, and compliance activities. Reporting to the Director of Audit & Compliance, the role leads and oversees the Information Security & Compliance team, coordinates compliance across the organization, leads audits and assessments, oversees risks and controls, and drives remediation and continual improvement. The position supports compliance with ISO 27001:2022, SOC 1, SOC 2, ISO 14001, ISO 50001, and other applicable frameworks, regulatory requirements, and organizational standards.

The manager supervises and develops Information Security & Compliance Analysts, sets priorities and manages workloads, reviews deliverables, and serves as an escalation point for complex matters. The role coordinates internal and external audits, certifications, attestations, assessments, evidence collection, audit responses, findings, and remediation. It also manages GRC platforms and processes, develops and maintains compliance documentation, advises business and technical teams, monitors changes to relevant requirements, and reports compliance and risk status to management and the ISO Steering Committee.

Requirements

• At least 7 years of professional experience in GRC, cybersecurity compliance, IT audit, risk management, or closely related functions.
• At least 5 years of hands-on experience with ISO 27001, SOC 1, SOC 2, and/or other recognized security, risk, or compliance frameworks.
• At least 5 years of hands-on experience using GRC platforms such as OneTrust, Hyperproof, RSA Archer, ServiceNow GRC, AuditBoard, LogicGate, or comparable solutions.
• At least 3 years of experience managing or directly supervising GRC, information security, audit, compliance, or related professionals.
• Experience leading, coaching, and developing team members, including setting priorities, managing workloads, reviewing deliverables, and supporting professional development.
• Experience leading internal and external audits, certification activities, control assessments, risk assessments, and remediation programs.
• Experience managing relationships with internal and external auditors, process owners, control owners, technical teams, and other stakeholders.
• Experience managing risks, controls, assessments, findings, corrective actions, and compliance reporting.
• Experience developing and maintaining policies, standards, procedures, controls, risk documentation, and compliance evidence.
• Experience coordinating multiple compliance frameworks, audits, assessments, and remediation activities simultaneously.
• Advanced working knowledge of ISO 27001, SOC 1, SOC 2, and related control environments.
• Strong knowledge of GRC principles, information security risk management, control design and effectiveness, audit methodologies, corrective actions, and continual improvement.
• Strong experience with GRC platforms and managing risk registers, control libraries, assessments, evidence, findings, remediation workflows, dashboards, and reporting.
• Leadership and people-management skills, including coaching, prioritization, delegation, performance management, and team development.
• Ability to manage multiple audits, certifications, assessments, risks, and remediation activities across different business functions and locations.
• Ability to translate framework, audit, regulatory, and contractual requirements into practical controls and business processes.
• Understanding of privacy, data protection, and applicable legal and regulatory requirements.
• Strong analytical and problem-solving skills, including assessing risk and recommending practical solutions.
• Strong project management, organizational, and prioritization skills.
• Strong written, verbal, and presentation skills, including effective communication with technical teams, process owners, auditors, and management.
• Ability to lead cross-functional compliance initiatives and drive timely completion of agreed remediation activities.
• Ability to exercise sound professional judgment and appropriately escalate significant risks or compliance concerns.
• Strong attention to documentation quality, evidence integrity, traceability, and audit readiness.
• Ability to operate effectively in a fast-paced and evolving environment.
• Proficiency with Microsoft Office applications, including Excel, Word, PowerPoint, Outlook, and Teams.

Nice To Haves

• Knowledge of ISO 14001 and ISO 50001; direct experience is a plus.
• Bachelor’s degree in a related field preferred.
• Relevant professional certifications such as ISO 27001 Lead Auditor/Lead Implementer, CISA, CRISC, CISM, CISSP, or equivalent GRC or information security credentials are strongly preferred.
• ISO 14001 and ISO 50001 auditor credentials are desirable.

Responsibilities

• Manage day-to-day execution and continual improvement of GRC, audit, information security compliance, and related programs.
• Provide direct management, guidance, coaching, and professional development to Information Security & Compliance Analysts.
• Assign and prioritize team activities, manage workloads and deadlines, and review deliverables for quality, consistency, completeness, and audit readiness.
• Serve as the primary escalation point for complex GRC, audit, risk, control, and compliance matters.
• Manage and support the Information Security Management System (ISMS) and compliance with ISO 27001:2022, SOC 1, SOC 2, and other applicable frameworks.
• Support management and continual improvement of ISO 14001 and ISO 50001 programs, as applicable.
• Lead and coordinate internal and external audits, certifications, attestations, and assessments, including planning, evidence collection, stakeholder coordination, audit responses, findings, and remediation.
• Manage risk assessments, control assessments, internal audits, gap assessments, and compliance reviews.
• Work with business and technical process owners to evaluate controls, identify gaps and risks, and establish practical remediation plans.
• Manage audit findings, non-conformities, risks, corrective actions, and remediation through closure, escalating significant or overdue matters as appropriate.
• Oversee governance and effective use of GRC platforms, including risk registers, control libraries, assessments, audit evidence, findings, remediation workflows, dashboards, and compliance reporting.
• Establish consistent GRC processes, methodologies, workflows, documentation, and reporting across the organization.
• Lead development, review, implementation, and maintenance of policies, standards, procedures, controls, and related compliance documentation.
• Coordinate documentation and evidence for certifications, attestations, customer requirements, audits, and regulatory obligations.
• Provide GRC, audit, risk, control, and compliance guidance to business and technical teams.
• Monitor changes to applicable standards, regulatory requirements, contractual obligations, and industry practices, and coordinate necessary updates to compliance activities.
• Prepare and present compliance, risk, audit, findings, and remediation status to management and the ISO Steering Committee.
• Support security and compliance awareness and training initiatives.
• Identify opportunities for automation, standardization, and process improvements that increase GRC efficiency, consistency, and effectiveness.
• Escalate significant compliance gaps, risks, control deficiencies, and unresolved remediation activities to the Director of Audit & Compliance.

Benefits

• Competitive compensation and rewarding incentives.
• Comprehensive benefits, including medical, dental, vision, life insurance, and disability coverage.
• 401(k) with match.
• 12 paid holidays.
• Generous PTO.
• Development opportunities.
• Opportunity to closely impact and contribute to the growth of the organization.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager
• Education Level: No Education Listed